# Confusion around geo.country\_iso\_code vs country\_code2 **URL:** \ **Category:** Logstash\ **Created:** [June 10, 2022, 8:37am UTC](https://discuss.elastic.co/t/confusion-around-geo-country-iso-code-vs-country-code2/306857 "2022-06-10T08:37:39Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![cawoodm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cawoodm/32/14083_2.png) [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Post date:** [June 10, 2022, 8:37am UTC](https://discuss.elastic.co/t/confusion-around-geo-country-iso-code-vs-country-code2/306857/1 "2022-06-10T08:37:39Z")
When we parse an IP for geo info using: ```ruby geoip { source => "ip" target => "client" fields => ["location", "country_code2", "country_name"] } ``` LogStash creates documents with: ```json client: { geo: { country_iso_code: "ZW" } } ``` Note the mysterious `country_iso_code` and no `country_code2`. When we change the field name in the filter: ```ruby geoip { source => "ip" target => "client" fields => ["location", "country_iso_code", "country_name"] } ``` LogStash balks with the following error: > Pipeline error {:pipeline\_id=\>"mybuhler-logs", :exception=\>java.lang.IllegalArgumentException: illegal field value country\_iso\_code. valid values are [AUTONOMOUS\_SYSTEM\_NUMBER, AUTONOMOUS\_SYSTEM\_ORGANIZATION, CITY\_NAME, COUNTRY\_NAME, CONTINENT\_CODE, CONTINENT\_NAME, COUNTRY\_CODE2, COUNTRY\_CODE3, DOMAIN, IP, ISP, POSTAL\_CODE, DMA\_CODE, REGION\_NAME, REGION\_CODE, REGION\_ISO\_CODE, TIMEZONE, LOCATION, LATITUDE, LONGITUDE, ORGANIZATION], :backtrace=\>["org.logstash.filters.geoip.Fields.parseField(org/logstash/filters/geoip/Fields.java:123)", "org.logstash.filters.geoip.GeoIPFilter.createDesiredFields(org/logstash/filters/geoip/GeoIPFilter.java:138)", "org.logstash.filters.geoip.GeoIPFilter.(org/logstash/filters/geoip/GeoIPFilter.java:94)", "jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)", "jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(jdk/internal/reflect/NativeConstructorAccessorImpl.java:62)", "jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(jdk/internal/reflect/DelegatingConstructorAccessorImpl.java:45)", "java.lang.reflect.Constructor.newInstance(java/lang/reflect/Constructor.java:490)", "org.jruby.javasupport.JavaConstructor.newInstanceDirect(org/jruby/javasupport/JavaConstructor.java:253)", "org.jruby.RubyClass.newInstance(org/jruby/RubyClass.java:939)", "org.jruby.RubyClass$INVOKER$i$newInstance.call(org/jruby/RubyClass$INVOKER$i$newInstance.gen)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_5\_dot\_0.gems.logstash\_minus\_filter\_minus\_geoip\_minus\_7\_dot\_2\_dot\_12\_minus\_java.lib.logstash.filters.geoip.setup\_filter(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.12-java/lib/logstash/filters/geoip.rb:152)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_5\_dot\_0.gems.logstash\_minus\_filter\_minus\_geoip\_minus\_7\_dot\_2\_dot\_12\_minus\_java.lib.logstash.filters.geoip.register(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.12-java/lib/logstash/filters/geoip.rb:109)", "org.jruby.RubyClass.finvoke(org/jruby/RubyClass.java:572)", "org.jruby.RubyBasicObject.callMethod(org/jruby/RubyBasicObject.java:354)", "org.logstash.config.ir.compiler.FilterDelegatorExt.doRegister(org/logstash/config/ir/compiler/FilterDelegatorExt.java:88)", "org.logstash.config.ir.compiler.AbstractFilterDelegatorExt.register(org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:75)", "org.logstash.config.ir.compiler.AbstractFilterDelegatorExt$INVOKER$i$0$0$register.call(org/logstash/config/ir/compiler/AbstractFilterDelegatorExt$INVOKER$i$0$0$register.gen)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.java\_pipeline.register\_plugins(/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:233)", "org.jruby.RubyArray.each(org/jruby/RubyArray.java:1821)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.java\_pipeline.register\_plugins(/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:232)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.java\_pipeline.maybe\_setup\_out\_plugins(/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:599)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.java\_pipeline.start\_workers(/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:245)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.java\_pipeline.run(/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:190)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.java\_pipeline.start(/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:142)", "org.jruby.RubyProc.call(org/jruby/RubyProc.java:318)", "java.lang.Thread.run(java/lang/Thread.java:829)"], "pipeline.sources"=\>["/etc/logstash/conf.d/mybuhler-logs/010-input-kafka.conf", "/etc/logstash/conf.d/mybuhler-logs/300-filter.conf", "/etc/logstash/conf.d/mybuhler-logs/350-ecs.conf", "/etc/logstash/conf.d/mybuhler-logs/400-filter\_email.conf", "/etc/logstash/conf.d/mybuhler-logs/900-output-es.conf"], :thread=\>"#\"} According to the [ecs docs](https://www.elastic.co/guide/en/ecs/current/ecs-geo.html) the official name of the field is `country_iso_code` so why won't LogStash/Elastic use it? Logstash 8.2 ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 10, 2022, 1:16pm UTC](https://discuss.elastic.co/t/confusion-around-geo-country-iso-code-vs-country-code2/306857/2 "2022-06-10T13:16:51Z")
There is a [mapping](https://github.com/logstash-plugins/logstash-filter-geoip/blob/099f1fdc659d205906cd79487c253609e57eadb4/src/main/java/org/logstash/filters/geoip/Fields.java#L33) from the name that has been used in the past to the ECS compatible name. So the short answer is "backwards compatibility". ---
**Author:** ![cawoodm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cawoodm/32/14083_2.png) [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Post date:** [June 16, 2022, 1:06pm UTC](https://discuss.elastic.co/t/confusion-around-geo-country-iso-code-vs-country-code2/306857/3 "2022-06-16T13:06:14Z")
Backwards compatibility explains why I _can_ use the old field name, not why I _can't_ use the new field name... ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 14, 2022, 1:06pm UTC](https://discuss.elastic.co/t/confusion-around-geo-country-iso-code-vs-country-code2/306857/4 "2022-07-14T13:06:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.