# Geoip country\_code3 always 2 chars

**URL:** <https://discuss.elastic.co/t/geoip-country-code3-always-2-chars/162962>\
**Category:** Logstash\
**Created:** [January 4, 2019, 1:33pm UTC](https://discuss.elastic.co/t/geoip-country-code3-always-2-chars/162962 "2019-01-04T13:33:25Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lorenzo\_Bagni](https://avatars.discourse-cdn.com/v4/letter/l/71e660/32.png) [@Lorenzo\_Bagni](https://discuss.elastic.co/u/Lorenzo_Bagni)\
**Post date:** [January 4, 2019, 1:33pm UTC](https://discuss.elastic.co/t/geoip-country-code3-always-2-chars/162962/1 "2019-01-04T13:33:25Z")

</div>

I've noticed that the field "country\_code3" of geoip filter always returns the code with only 2 chars instead 3.

Configuration:  
input { stdin { }  
filter { geoip { source =\> "message" } }  
output { stdout { codec =\> rubydebug } }

Log:  
[INFO] 2019-01-04 11:42:45.502 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=\>"6.5.4"}  
[INFO] 2019-01-04 11:42:51.952 [[main]-pipeline-manager] geoip - Using geoip database {:path=\>"/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-geoip-5.0.3-java/vendor/GeoLite2-City.mmdb"}  
[INFO] 2019-01-04 11:42:52.377 [Converge PipelineAction::Create] pipeline - Pipeline started successfully {:pipeline\_id=\>"main", :thread=\>"#\<Thread:0x565ad322 run\>"}  
The stdin plugin is now waiting for input:

73.182.32.7

{  
"@timestamp" =\> 2019-01-04T11:53:03.994Z,  
"geoip" =\> {  
"city\_name" =\> "Savannah",  
"region\_code" =\> "GA",  
"timezone" =\> "America/New\_York",  
"continent\_code" =\> "NA",  
"latitude" =\> 31.9951,  
"region\_name" =\> "Georgia",  
"location" =\> {  
"lat" =\> 31.9951,  
"lon" =\> -81.2723  
},  
"postal\_code" =\> "31419",  
"country\_name" =\> "United States",  
"dma\_code" =\> 507,  
**"country\_code3" =\> "US"** ,  
"ip" =\> "73.182.32.7",  
"longitude" =\> -81.2723,  
"country\_code2" =\> "US"  
},  
"host" =\> "host.domain",  
"message" =\> "73.182.32.7",  
"@version" =\> "1"  
}

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 1, 2019, 1:33pm UTC](https://discuss.elastic.co/t/geoip-country-code3-always-2-chars/162962/2 "2019-02-01T13:33:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.