# Geo IP throwing wrong Country names

**URL:** <https://discuss.elastic.co/t/geo-ip-throwing-wrong-country-names/56990>\
**Category:** Logstash\
**Created:** [August 2, 2016, 10:05am UTC](https://discuss.elastic.co/t/geo-ip-throwing-wrong-country-names/56990 "2016-08-02T10:05:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kishore](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@Kishore](https://discuss.elastic.co/u/Kishore)\
**Post date:** [August 2, 2016, 10:05am UTC](https://discuss.elastic.co/t/geo-ip-throwing-wrong-country-names/56990/1 "2016-08-02T10:05:30Z")

</div>

Hi Elastic,

Geo IP Plugin is not populating correct information. and for some of the IPs it is not showing the City Name.

Ex: 170.251.154.205 This IP belongs to Bangalore and India, but in Kibana it is showing as Dallas, USA.

Based on this we generating some alerts, this is in Production and our Support team will take an action on this.

Below is the configuration:

```
geoip 
		{
           		add_tag => ["GeoIP"]
           		source => "public_ip"
           		add_field => ["[geoip][coordinates]","%{[geoip][longitude]}"]
           		add_field => ["[geoip][coordinates]","%{[geoip][latitude]}"]

       	}
   		mutate 
		{
      			convert => ["[geoip][coordinates]", "float" ]
   		}
```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 2, 2016, 10:10am UTC](https://discuss.elastic.co/t/geo-ip-throwing-wrong-country-names/56990/2 "2016-08-02T10:10:38Z")

</div>

> [@Kishore](#):
>
> Ex: 170.251.154.205 This IP belongs to Bangalore and India, but in Kibana it is showing as Dallas, USA.

You would need to update the database it uses, what is provided is only a snapshot in time and IP allocation can change.

---

<div class="post-metadata">

**Author:** ![Kishore](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@Kishore](https://discuss.elastic.co/u/Kishore)\
**Post date:** [August 2, 2016, 10:11am UTC](https://discuss.elastic.co/t/geo-ip-throwing-wrong-country-names/56990/3 "2016-08-02T10:11:36Z")

</div>

Thanks Mark,

Kindly advise me how to update the Database

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 2, 2016, 10:42am UTC](https://discuss.elastic.co/t/geo-ip-throwing-wrong-country-names/56990/4 "2016-08-02T10:42:42Z")

</div>

Download it from Maxmind and then use [https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html#plugins-filters-geoip-database](https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html#plugins-filters-geoip-database) to point to the updated database file.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:45am UTC](https://discuss.elastic.co/t/geo-ip-throwing-wrong-country-names/56990/5 "2017-07-06T04:45:24Z")

</div>