# Winlogbeat fails to add geotags

**URL:** <https://discuss.elastic.co/t/winlogbeat-fails-to-add-geotags/139948>\
**Category:** Logstash\
**Created:** [July 13, 2018, 1:16pm UTC](https://discuss.elastic.co/t/winlogbeat-fails-to-add-geotags/139948 "2018-07-13T13:16:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![victor.nilsson](https://avatars.discourse-cdn.com/v4/letter/v/eb8c5e/32.png) [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\
**Post date:** [July 13, 2018, 1:16pm UTC](https://discuss.elastic.co/t/winlogbeat-fails-to-add-geotags/139948/1 "2018-07-13T13:16:59Z")

</div>

Hi,

We are shipping some windows logs using winlogbeat to our logstash nodes and then to our elastic cluster. We have successfully installed the geoip plugin on all of our elasticsearch nodes. Here is our logstash configuration for winlogbeat:

1001-inputs-beat.conf:

> input {  
> beats {  
> port =\> 5044  
> id =\> "beats-input"  
> tags =\> "beats"  
> }  
> }

3001-filter-beats.conf:

> filter {  
> if "beats" in [tags] {  
> mutate {  
> remove\_field =\> ["host"]  
> }  
> geoip {  
> source =\> "[event\_data][IpAddress]"  
> target =\> "geo\_point"  
> }  
> }  
> }

9000-output-elastic.conf:

> output {  
> elasticsearch {  
> hosts =\> ["10.229.1.12:9200", "10.229.1.13:9200"]  
> index =\> "%{[@metadata][beat]}-%{+YYYY-MM-dd}"  
> user =\> logstash\_internal  
> password =\> password  
> }  
> }

I then updated our winlogbeat template with the following:

```
"mappings": {
    "doc": {
      "properties": {
        "geoip" : {
          "dynamic": true,
          "properties" : {
            "ip": { "type": "ip" },
            "location" : { "type" : "geo_point" },
            "latitude" : { "type" : "float" },
            "longitude" : { "type" : "float" }
          }
        }
      }
    }
  }

```

However, no geotags are showing up in our index. We have succesfully added geotags to our syslog index but cannot seem to figure out how to add it to our windows logs... We have also tried following this guide, [Monitoring Windows Logons with Winlogbeat | Elastic Blog](https://www.elastic.co/blog/monitoring-windows-logons-with-winlogbeat), but that didn't help us with our problem unfortunately.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 27, 2018, 4:11pm UTC](https://discuss.elastic.co/t/winlogbeat-fails-to-add-geotags/139948/2 "2018-07-27T16:11:13Z")

</div>

Your geoip filter stores the geo data in the `geo_point` field but the mapping snippet you're showing us sets the `geoip` field as the field containing the geo\_point value.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 24, 2018, 4:23pm UTC](https://discuss.elastic.co/t/winlogbeat-fails-to-add-geotags/139948/3 "2018-08-24T16:23:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.