# Using LS 2.0, can't get split and/or geoip working - trying to split my xforwardfor field and pass into geoip

**URL:** <https://discuss.elastic.co/t/using-ls-2-0-cant-get-split-and-or-geoip-working-trying-to-split-my-xforwardfor-field-and-pass-into-geoip/35354>\
**Category:** Logstash\
**Created:** [November 23, 2015, 7:37pm UTC](https://discuss.elastic.co/t/using-ls-2-0-cant-get-split-and-or-geoip-working-trying-to-split-my-xforwardfor-field-and-pass-into-geoip/35354 "2015-11-23T19:37:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![scumola](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/scumola/32/6113_2.png) [@scumola](https://discuss.elastic.co/u/scumola)\
**Post date:** [November 23, 2015, 7:37pm UTC](https://discuss.elastic.co/t/using-ls-2-0-cant-get-split-and-or-geoip-working-trying-to-split-my-xforwardfor-field-and-pass-into-geoip/35354/1 "2015-11-23T19:37:18Z")

</div>

My LS filter config line:

> split {  
> field =\> "xforwardfor"  
> terminator =\> ","  
> }

but in kibana, I still see the field as one string

```
"referer": "http://www.mysite.com/",
"xforwardfor": "1.2.3.4, 5.6.7.8",
"hostname": "myhostname", 

```

I tried deleting all of the indices using curator just in case there was a mapping conflict, but it didn't seem to help.

I didn't see an errors in logstash or elasticsearch logs

I'm also trying to pass this into geoip, but first things first - to split the string...

my geoip filter config:

> geoip {  
> source =\> "xforwardfor"  
> target =\> "geoip"  
> database =\> "/opt/logstash/vendor/geoip/GeoLiteCity.dat"  
> }

geoip and geoip.location are of type geo\_point but don't get populated with anything.

I'm using the latest ELK stack as of Nov 20, 2015 (ES 2.0.0, LS 2.0.0-1, KIBANA 4.2.1)

---

<div class="post-metadata">

**Author:** ![scumola](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/scumola/32/6113_2.png) [@scumola](https://discuss.elastic.co/u/scumola)\
**Post date:** [November 23, 2015, 7:46pm UTC](https://discuss.elastic.co/t/using-ls-2-0-cant-get-split-and-or-geoip-working-trying-to-split-my-xforwardfor-field-and-pass-into-geoip/35354/2 "2015-11-23T19:46:50Z")

</div>

Even xforwardfor headers with only a single IP aren't getting geoip location strings. Screengrab:

 ![](https://us1.discourse-cdn.com/elastic/original/2X/d/d659f60e11c75bd23dd87b7958d3f0075bda118d.png)

---

<div class="post-metadata">

**Author:** ![scumola](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/scumola/32/6113_2.png) [@scumola](https://discuss.elastic.co/u/scumola)\
**Post date:** [November 23, 2015, 9:22pm UTC](https://discuss.elastic.co/t/using-ls-2-0-cant-get-split-and-or-geoip-working-trying-to-split-my-xforwardfor-field-and-pass-into-geoip/35354/3 "2015-11-23T21:22:59Z")

</div>

You know what, nevermind. You can close this issue.

I was using fluentd to pipe logs into ELK, but I figured out that fluentd just ships logs directly into elasticsearch and bypasses logstash altogether. This is why things in my logstash config made no difference. Sorry for the bandwidth.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:21am UTC](https://discuss.elastic.co/t/using-ls-2-0-cant-get-split-and-or-geoip-working-trying-to-split-my-xforwardfor-field-and-pass-into-geoip/35354/4 "2017-07-06T05:21:40Z")

</div>