I would like to understand how does Elastic translate the Geo Location of users by their IP?
How accurate is it indeed?
And a general question : is it possible that an internet provider will assign the same IP (random IP, not constant) to different users,
thus resulting quite a mess in the real view of users' location?
I would like to understand how does Elastic translate the Geo Location of users by their IP?
It's a static lookup table shipped with Logstash's geoip filter. You can replace it if you want. See the geoip filter docs for some more details.
And a general question : is it possible that an internet provider will assign the same IP (random IP, not constant) to different users,
thus resulting quite a mess in the real view of users’ location?
ISPs will certainly assign the same IP to different users over time, but the IP ranges of ISPs is typically tied to reasonably small geographical areas like cities.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.