---
title: "Transferring your logs to Elasticsearch using GeoIP2"
url: "https://axoflow.com/docs/axosyslog-core/4.28/chapter-enrich-data/geoip2-parser/transferring-your-logs-to-elasticsearch-using-geoip2/"
last_modified: "2023-07-02T20:37:04+02:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axosyslog-core/4.28/llms.txt).

# Transferring your logs to Elasticsearch using GeoIP2

If you are transferring your log messages into Elasticsearch, use the following rewrite rule to combine the longitude and latitude information into a single value (called `geoip2.location`), and set the mapping in Elasticsearch accordingly. Do not forget to include the rewrite in your log path. These examples assume that you used `prefix("geoip2.")` instead of the default for the `geoip2` parser. For details on transferring your log messages to Elasticsearch, see [elasticsearch2: DEPRECATED - Send messages directly to Elasticsearch version 2.0 or higher](https://axoflow.com/docs/axosyslog-core/4.28/chapter-destinations/configuring-destinations-elasticsearch2/index.md).

```shell
   rewrite r_geoip2 {
        set(
            "${geoip2.location.latitude},${geoip2.location.longitude}",
            value( "geoip2.location2" ),
            condition(not "${geoip2.location.latitude}" == "")
        );
    };
```

In your Elasticsearch configuration, set the appropriate mappings:

```shell
   {
       "mappings" : {
          "_default_" : {
             "properties" : {
                "geoip2" : {
                   "properties" : {
                      "location2" : {
                         "type" : "geo_point"
                      }
                   }
                }
             }
          }
       }
    }
```

Last modified July 2, 2023: [Change highlight mode of code examples (2f8a9593)](https://github.com/axoflow/axosyslog-core-docs/commit/2f8a95937c6498193e7168ce8b0dc831e9f0f8ad)