# Transferring your logs to Elasticsearch using GeoIP2

If you are transferring your log messages into Elasticsearch, use the following rewrite rule to combine the longitude and latitude information into a single value (called `geoip2.location`), and set the mapping in Elasticsearch accordingly. Do not forget to include the rewrite in your log path. These examples assume that you used `prefix("geoip2.")` instead of the default for the `geoip2` parser. For details on transferring your log messages to Elasticsearch, see [elasticsearch2: DEPRECATED - Send messages directly to Elasticsearch version 2.0 or higher](../../../docs/axosyslog-core/chapter-destinations/configuring-destinations-elasticsearch2/index.md).
```
 
       rewrite r_geoip2 {
            set(
                "${geoip2.location.latitude},${geoip2.location.longitude}",
                value( "geoip2.location2" ),
                condition(not "${geoip2.location.latitude}" == "")
            );
        };
    
```

In your Elasticsearch configuration, set the appropriate mappings:
```
 
       {
           "mappings" : {
              "_default_" : {
                 "properties" : {
                    "geoip2" : {
                       "properties" : {
                          "location2" : {
                             "type" : "geo_point"
                          }
                       }
                    }
                 }
              }
           }
        }
    
```

Last modified July 2, 2023: [Change highlight mode of code examples (2f8a959)](<https://github.com/axoflow/axosyslog-core-docs/commit/2f8a95937c6498193e7168ce8b0dc831e9f0f8ad>)