# Crash when loading IPv6 GeoIP database

**URL:** <https://discuss.elastic.co/t/crash-when-loading-ipv6-geoip-database/48227>\
**Category:** Logstash\
**Created:** [April 23, 2016, 1:35pm UTC](https://discuss.elastic.co/t/crash-when-loading-ipv6-geoip-database/48227 "2016-04-23T13:35:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![icb](https://avatars.discourse-cdn.com/v4/letter/i/b2d939/32.png) [@icb](https://discuss.elastic.co/u/icb)\
**Post date:** [April 23, 2016, 1:35pm UTC](https://discuss.elastic.co/t/crash-when-loading-ipv6-geoip-database/48227/1 "2016-04-23T13:35:08Z")

</div>

I'm wanting to be able to geolocate IPv6 addresses. MaxMind publish a [free (beta) IPv6 database](http://dev.maxmind.com/geoip/legacy/geolite/) along side their free IPv4 database, but when I configure it, logstash crashes during initialization. Has anyone gotten this to work?

```
[icb@n logstash-2.3.1]$ ./bin/logstash -f v6test.conf
Settings: Default pipeline workers: 1
Pipeline aborted due to error {:exception=>#<NameError: uninitialized constant LogStash::Filters::GeoIP::RuntimeException>, :backtrace=>["org/jruby/RubyModule.java:2745:in `const_missing'", "/home/icb/elastic/logstash-2.3.1/vendor/bundle/jruby/1.9/gems/logstash-filter-geoip-2.0.7/lib/logstash/filters/geoip.rb:114:in `register'", "/home/icb/elastic/logstash-2.3.1/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.1-java/lib/logstash/pipeline.rb:182:in `start_workers'", "org/jruby/RubyArray.java:1613:in `each'", "/home/icb/elastic/logstash-2.3.1/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.1-java/lib/logstash/pipeline.rb:182:in `start_workers'", "/home/icb/elastic/logstash-2.3.1/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.1-java/lib/logstash/pipeline.rb:136:in `run'", "/home/icb/elastic/logstash-2.3.1/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.1-java/lib/logstash/agent.rb:465:in `start_pipeline'"], :level=>:error}
stopping pipeline {:id=>"main"}
[icb@n logstash-2.3.1]$

```

Minimal config to reproduce this (with the GeoLite City IPv6 (Beta) database put at the geoip database path):

```
input {
	stdin {}
}
filter {
	grok {
		match => {
			"message" => "%{SYSLOGBASE} queries: info: client %{IP:clientip}#%{INT:port}: query: %{DATA:query} %{WORD:class} %{WORD:querytype} %{DATA:flags} \(%{IP:serverip}\)"
		}
	}
	geoip {
		database => "/home/icb/elastic/maxmind/GeoLiteCityv6.dat"
		source => "clientip"
	}
}
output {
	elasticsearch {}
}
```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 23, 2016, 10:48pm UTC](https://discuss.elastic.co/t/crash-when-loading-ipv6-geoip-database/48227/2 "2016-04-23T22:48:04Z")

</div>

I don't believe that LS filter handles IPv6 - [https://github.com/logstash-plugins/logstash-filter-geoip/issues?utf8=✓&q=is%3Aissue+is%3Aopen+ipv6](https://github.com/logstash-plugins/logstash-filter-geoip/issues?utf8=%E2%9C%93&q=is%3Aissue+is%3Aopen+ipv6)

---

<div class="post-metadata">

**Author:** ![icb](https://avatars.discourse-cdn.com/v4/letter/i/b2d939/32.png) [@icb](https://discuss.elastic.co/u/icb)\
**Post date:** [April 23, 2016, 11:05pm UTC](https://discuss.elastic.co/t/crash-when-loading-ipv6-geoip-database/48227/3 "2016-04-23T23:05:56Z")

</div>

Thanks. Looks like support was added in [PR 64](https://github.com/logstash-plugins/logstash-filter-geoip/pull/64) (not yet released), but comments suggest that also dropped support for the ASN database.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:01am UTC](https://discuss.elastic.co/t/crash-when-loading-ipv6-geoip-database/48227/4 "2017-07-06T05:01:01Z")

</div>