communigate password fail geoip logstash config

logstash.conf

input {
  beats {
    port => 50441
    ssl => false
  }
}

filter {
  if "communigate-log" in [tags] {
    grok {
      match => [ "message", "%{INT} (SMTPI|IMAP)-%{INT}\(\[%{IP:ip}\]?.+\) failed to open ACCOUNT\(%{DATA:account}\) %{DATA} Error Code=%{GREEDYDATA:errorcode}" ]
      add_tag => ["auth-fail-smtp"]
    }

    geoip {
      source => "ip"
      target => "geoip"
      add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
      add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
    }

    mutate {
      convert => [ "[geoip][coordinates]", "float"]
    }
  }

  grok {
    match => [ "message", "%{MONTH:month} %{MONTHDAY:day} %{TIME:time} %{HOSTNAME:hostname} %{DATA} Failed password for %{WORD:username} from %{IP:ip}" ]
    add_tag => ["auth-fail-ssh"]
  }
}

output {
  elasticsearch {
    hosts => ["localhost:9200"]
    index => "n8gs-tz-%{+YYYY.MM.dd}"
  }
}