# "destination.geo.country\_iso\_code" field with logstash geoip?

**URL:** <https://discuss.elastic.co/t/destination-geo-country-iso-code-field-with-logstash-geoip/257482>\
**Category:** Logstash\
**Created:** [December 3, 2020, 9:59am UTC](https://discuss.elastic.co/t/destination-geo-country-iso-code-field-with-logstash-geoip/257482 "2020-12-03T09:59:08Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Camille](https://avatars.discourse-cdn.com/v4/letter/c/22d042/32.png) [@Camille](https://discuss.elastic.co/u/Camille)\
**Post date:** [December 3, 2020, 9:59am UTC](https://discuss.elastic.co/t/destination-geo-country-iso-code-field-with-logstash-geoip/257482/1 "2020-12-03T09:59:08Z")

</div>

Hi,

is it possible to have to " destination.geo.country\_iso\_code" field with the geoip plugin in logstash ?

I use it but similar output fields are "destination.geo.country\_code2" and "destination.geo.country\_code3" and these fields are not usable in the SIEM for destination country.

Thanks for help.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 4, 2020, 2:04am UTC](https://discuss.elastic.co/t/destination-geo-country-iso-code-field-with-logstash-geoip/257482/2 "2020-12-04T02:04:26Z")

</div>

I may be misunderstanding your question, but it doesn't look like that is a possible value from the filter - [https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html#plugins-filters-geoip-fields](https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html#plugins-filters-geoip-fields)

---

<div class="post-metadata">

**Author:** ![Camille](https://avatars.discourse-cdn.com/v4/letter/c/22d042/32.png) [@Camille](https://discuss.elastic.co/u/Camille)\
**Post date:** [December 4, 2020, 7:29am UTC](https://discuss.elastic.co/t/destination-geo-country-iso-code-field-with-logstash-geoip/257482/3 "2020-12-04T07:29:08Z")

</div>

Hi Mark,

you understand well 🙂

I was wondering if there is any way to do it (change output name, rename field or other), and want to understand the difference between filter and the processor which have this "coutry\_iso\_code" with the same Maxmind database (see [GeoIP processor | Elasticsearch Reference [7.10] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.10/geoip-processor.html#using-ingest-geoip))

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 7, 2020, 1:51am UTC](https://discuss.elastic.co/t/destination-geo-country-iso-code-field-with-logstash-geoip/257482/4 "2020-12-07T01:51:21Z")

</div>

The database might be the same but the implementation is slightly different.  
Can you look at using it instead?

---

<div class="post-metadata">

**Author:** ![Camille](https://avatars.discourse-cdn.com/v4/letter/c/22d042/32.png) [@Camille](https://discuss.elastic.co/u/Camille)\
**Post date:** [December 7, 2020, 3:59pm UTC](https://discuss.elastic.co/t/destination-geo-country-iso-code-field-with-logstash-geoip/257482/5 "2020-12-07T15:59:07Z")

</div>

Hi,

I can't do it now, but will look at it in the next few months when migrating.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 4, 2021, 3:59pm UTC](https://discuss.elastic.co/t/destination-geo-country-iso-code-field-with-logstash-geoip/257482/6 "2021-01-04T15:59:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.