# Debugging geoip plugin - Ruby @logger statements appear but not Java logger

**URL:** <https://discuss.elastic.co/t/debugging-geoip-plugin-ruby-logger-statements-appear-but-not-java-logger/254644>\
**Category:** Logstash\
**Created:** [November 7, 2020, 10:40pm UTC](https://discuss.elastic.co/t/debugging-geoip-plugin-ruby-logger-statements-appear-but-not-java-logger/254644 "2020-11-07T22:40:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![hukel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hukel/32/78624_2.png) [@hukel](https://discuss.elastic.co/u/hukel)\
**Post date:** [November 7, 2020, 10:40pm UTC](https://discuss.elastic.co/t/debugging-geoip-plugin-ruby-logger-statements-appear-but-not-java-logger/254644/1 "2020-11-07T22:40:48Z")

</div>

I know the geoip plugin has some limitations when handling private IP addresses so I am not trying to solve that problem. I am trying to get debug output from the plugin to explain where it is giving up when processing my IP input.

My logstash has the plugin at debug level (checked via curl)  
"logstash.filters.geoip" : "DEBUG",

I am getting output from [geoip.rb](https://github.com/logstash-plugins/logstash-filter-geoip/blob/1b8e98191bd59273609219c64ba6ceab92708a97/lib/logstash/filters/geoip.rb)  
[logstash.filters.geoip][main] IP 10.99.99.99 was not found in the database {:event=\>#LogStash::Event:0x5dc19e63}

```auto
    def tag_unsuccessful_lookup(event)
    @logger.debug? && @logger.debug("IP #{event.get(@source)} was not found in the database", :event => event)`

```

I am not seeing any of these three debug messages from [GeoIPFilter.java](https://github.com/logstash-plugins/logstash-filter-geoip/blob/14676d9f4408862163c327be597fa882b4753983/src/main/java/org/logstash/filters/GeoIPFilter.java)

```auto
        } catch (UnknownHostException e) {
      logger.debug("IP Field contained invalid IP address or hostname. exception={}, field={}, event={}", e, sourceField, event);
    } catch (AddressNotFoundException e) {
      logger.debug("IP not found! exception={}, field={}, event={}", e, sourceField, event);
    } catch (GeoIp2Exception | IOException e) {
      logger.debug("GeoIP2 Exception. exception={}, field={}, event={}", e, sourceField, event);
    }

```

Do I need to configure something differently to capture those "logger" outputs from within the plugin's Java code?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 7, 2020, 11:10pm UTC](https://discuss.elastic.co/t/debugging-geoip-plugin-ruby-logger-statements-appear-but-not-java-logger/254644/2 "2020-11-07T23:10:09Z")

</div>

Add

```auto
loggers = geoip
logger.geoip.name = org.logstash.filters.GeoIPFilter
logger.geoip.level = DEBUG
logger.geoip.appenderRef.plain_console.ref = plain_console
logger.geoip.additivity = false

```

to /etc/logstash/log4j2.properties

Adjust the appenderRef as needed.

---

<div class="post-metadata">

**Author:** ![hukel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hukel/32/78624_2.png) [@hukel](https://discuss.elastic.co/u/hukel)\
**Post date:** [November 8, 2020, 12:15am UTC](https://discuss.elastic.co/t/debugging-geoip-plugin-ruby-logger-statements-appear-but-not-java-logger/254644/3 "2020-11-08T00:15:56Z")

</div>

Many thanks. I tried searching for that answer but I was getting lost in a sea of suggestions about reading/ingesting log4j.

I used your answer to get to this log4j.properties config:

```auto
# Ruby class
logger.geoipruby.name = logstash.filters.geoip
logger.geoipruby.level = debug

# Java class
logger.geoipjava.name = org.logstash.filters.GeoIPFilter
logger.geoipjava.level = DEBUG
logger.geoipjava.appenderRef.plain_console.ref = plain_console

```

That gives me the extra messages I need:

```auto
[DEBUG][org.logstash.filters.GeoIPFilter][main] IP Field contained invalid IP address or hostname. exception=java.net.UnknownHostException: 10.99.6.X, field=[source][ip], event=2020-11-08T00:08:56.252Z XXXX %{message}
[DEBUG][logstash.filters.geoip][main] IP 10.99.6.X was not found in the database {:event=>#<LogStash::Event:0x3727f106>}

[DEBUG][org.logstash.filters.GeoIPFilter][main] GeoIP2 Exception. exception=com.fasterxml.jackson.databind.exc.MismatchedInputException: Cannot deserialize instance of `java.util.ArrayList` out of START_OBJECT token
 at [Source: UNKNOWN; line: -1, column: -1] (through reference chain: com.maxmind.geoip2.model.CityResponse["subdivisions"]), field=[source][ip], event=2020-11-08T00:08:56.123Z XXXX %{message}
[DEBUG][logstash.filters.geoip][main] IP 10.99.6.20 was not found in the database {:event=>#<LogStash::Event:0x6e6ef3a3>}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 6, 2020, 12:15am UTC](https://discuss.elastic.co/t/debugging-geoip-plugin-ruby-logger-statements-appear-but-not-java-logger/254644/4 "2020-12-06T00:15:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.