# Geoip filter reports incorrect location

**URL:** <https://discuss.elastic.co/t/geoip-filter-reports-incorrect-location/165667>\
**Category:** Logstash\
**Created:** [January 24, 2019, 9:22pm UTC](https://discuss.elastic.co/t/geoip-filter-reports-incorrect-location/165667 "2019-01-24T21:22:00Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![andrew](https://avatars.discourse-cdn.com/v4/letter/a/f19dbf/32.png) [@andrew](https://discuss.elastic.co/u/andrew)\
**Post date:** [January 24, 2019, 9:22pm UTC](https://discuss.elastic.co/t/geoip-filter-reports-incorrect-location/165667/1 "2019-01-24T21:22:00Z")

</div>

I discovered some incorrect results when geocoding IP addresses through the **geoip** filter in Logsstash 6.5.4. The IP address in question is **185.234.217.248**.

If I go to [https://www.maxmind.com/en/geoip-demo](https://www.maxmind.com/en/geoip-demo) it gives me:

 ![Untitled](https://us1.discourse-cdn.com/elastic/original/3X/0/2/025e6db45869839c23a61ebd0612399a185b1bee.png)

However, if I run it through Logstash's geoip filter I get:

```
         "geoip" => {
          "latitude" => 52.2394,
    "continent_code" => "EU",
          "location" => {
        "lat" => 52.2394,
        "lon" => 21.0362
    },
      "country_name" => "Poland",
                "ip" => "185.234.217.248",
         "longitude" => 21.0362,
          "timezone" => "Europe/Warsaw",
     "country_code3" => "PL",
     "country_code2" => "PL"
}

```

Is Logstash shipping with a stale database?

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [January 26, 2019, 8:24am UTC](https://discuss.elastic.co/t/geoip-filter-reports-incorrect-location/165667/2 "2019-01-26T08:24:15Z")

</div>

Version 5.0.3 of the plugin was released shortly after Logstash 6.5.4 was cut, but includes an updated GeoLite2 database.

Instructions for updating plugins are [here](https://www.elastic.co/guide/en/logstash/current/working-with-plugins.html#updating-plugins).

---

<div class="post-metadata">

**Author:** ![andrew](https://avatars.discourse-cdn.com/v4/letter/a/f19dbf/32.png) [@andrew](https://discuss.elastic.co/u/andrew)\
**Post date:** [January 28, 2019, 7:48pm UTC](https://discuss.elastic.co/t/geoip-filter-reports-incorrect-location/165667/3 "2019-01-28T19:48:33Z")

</div>

Thanks @yaauie. Is there a best practice for operationalizing the periodic updates of the plugin? I imagine there must be lot's of people using Logstash for a long time who unknowingly are getting incorrect geo lookups due to stale databases. Maybe Logstash could allow plugins to upgrade themselves?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 28, 2019, 8:20pm UTC](https://discuss.elastic.co/t/geoip-filter-reports-incorrect-location/165667/4 "2019-01-28T20:20:35Z")

</div>

MaxMind release a new version of the database once a month. I don't think it is Elastic's job to keep the GeoLite2-City.mmdb on my install up to date for me. YMMV.

It might be worth documenting the fact that the database is a snapshot from around the time the plugin version was released.

Given the terrible quality of most free geolocation data I'm not terribly concerned about it being a little stale. You can tell from the frequency with which the location is the former corporate HQ of a cable company that has been rolled up that a lot of the time it is just whois data warmed over.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 25, 2019, 8:23pm UTC](https://discuss.elastic.co/t/geoip-filter-reports-incorrect-location/165667/5 "2019-02-25T20:23:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.