# APM GeoIP on Logstash vs Elastic Ingest

**URL:** <https://discuss.elastic.co/t/apm-geoip-on-logstash-vs-elastic-ingest/182018>\
**Category:** APM\
**Created:** [May 21, 2019, 2:00pm UTC](https://discuss.elastic.co/t/apm-geoip-on-logstash-vs-elastic-ingest/182018 "2019-05-21T14:00:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![digitalron](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/digitalron/32/38224_2.png) [@digitalron](https://discuss.elastic.co/u/digitalron)\
**Post date:** [May 21, 2019, 2:00pm UTC](https://discuss.elastic.co/t/apm-geoip-on-logstash-vs-elastic-ingest/182018/1 "2019-05-21T14:00:50Z")

</div>

Elastic Stack: 7.0.1, Docker Version

We are encountering a problem with the GeoIP filter seemingly having a different behaviour on Logstash versus using the Elasticsearch ingest pipeline. Please see below:

On Logstash:  
 ![56](https://us1.discourse-cdn.com/elastic/original/3X/9/3/9363028eaae9748ae56b37ab50c0d27651f2148e.png)

On Elasticsearch Ingest:  
 ![59](https://us1.discourse-cdn.com/elastic/original/3X/5/9/5959f1fb7305b826d595681c5d7dec77c87e3299.png)

Using the Logstash version generates more data (which we like) but it doesn't seem to generate the country\_iso\_code field and instead created country\_code2, country\_code3.

Is this by design or are we missing something?

Below are our filter settings:

Logstash filter:

```
filter {

    geoip {
      source => "[client][ip]"
      target => "client.geo"
    }

}

```

Ingest filter:

```
"processors" : [
      {
        "geoip" : {
          "field": "client.ip",
          "target_field": "client.geo",
          "ignore_missing": true
        }    
      }
    ]
```

---

<div class="post-metadata">

**Author:** ![gil](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gil/32/41911_2.png) [@gil](https://discuss.elastic.co/u/gil)\
**Post date:** [May 22, 2019, 6:24pm UTC](https://discuss.elastic.co/t/apm-geoip-on-logstash-vs-elastic-ingest/182018/2 "2019-05-22T18:24:55Z")

</div>

I don't think you're missing anything. I've opened an [issue](https://github.com/logstash-plugins/logstash-filter-geoip/issues/155) for handling `country_iso_code` - as you noted the other fields line up correctly. As I'm sure you've considered, you can use logstash to [rename](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-rename) that field.

---

<div class="post-metadata">

**Author:** ![digitalron](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/digitalron/32/38224_2.png) [@digitalron](https://discuss.elastic.co/u/digitalron)\
**Post date:** [May 23, 2019, 10:21am UTC](https://discuss.elastic.co/t/apm-geoip-on-logstash-vs-elastic-ingest/182018/3 "2019-05-23T10:21:56Z")

</div>

Thanks Gil! We'll wait for that as we have different deployments, some using Logstash, some none.

Kibana Index Patterns shows the following fields:

 ![44](https://us1.discourse-cdn.com/elastic/original/3X/f/b/fbb1e74b44dc09fe10f6f188971b9e6f75c88258.png)  
which has the field country\_iso\_code similar to the one used in the Elastic ingest.

Also, our queries result in errors if we use country\_code2 or country\_code3 instead of country\_iso\_code, but country\_iso\_code is all null.

So what we did was to update the template file and include the fields used in the Logstash filter. We also adjusted our query to use country\_code2 instead. We're not sure we want to use **rename** in our Logstash as we want to keep it as simple as possible and stay with our principle of using as few custom filters/rules as possible.

BTW, looking at logs in Logstash, it seems the acceptable fields for the Logstash GeoIP filter are as specified in the sample entry below:

`Pipeline aborted due to error {:pipeline_id=>"main", :exception=>java.lang.IllegalArgumentException: illegal field value country_iso_code. valid values are [AUTONOMOUS_SYSTEM_NUMBER, AUTONOMOUS_SYSTEM_ORGANIZATION, CITY_NAME, COUNTRY_NAME, CONTINENT_CODE, CONTINENT_NAME, COUNTRY_CODE2, COUNTRY_CODE3, IP, ISP, POSTAL_CODE, DMA_CODE, REGION_NAME, REGION_CODE, TIMEZONE, LOCATION, LATITUDE, LONGITUDE, ORGANIZATION]`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 13, 2019, 6:22am UTC](https://discuss.elastic.co/t/apm-geoip-on-logstash-vs-elastic-ingest/182018/4 "2019-06-13T06:22:01Z")

</div>

This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.