# GeoIP lookup failed

**URL:** <https://discuss.elastic.co/t/geoip-lookup-failed/241414>\
**Category:** Logstash\
**Created:** [July 16, 2020, 8:19am UTC](https://discuss.elastic.co/t/geoip-lookup-failed/241414 "2020-07-16T08:19:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alex\_Liu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_liu/32/47533_2.png) [@Alex\_Liu](https://discuss.elastic.co/u/Alex_Liu)\
**Post date:** [July 16, 2020, 8:19am UTC](https://discuss.elastic.co/t/geoip-lookup-failed/241414/1 "2020-07-16T08:19:22Z")

</div>

Hi,

how to debug GeoIP lookup failure? For below attached screenshot, why the first clientIP: 123.58.60.5 lookup failed, but the second one 112.85.231.147 succeed?

 ![image (1)](https://us1.discourse-cdn.com/elastic/original/3X/7/f/7ffd60e168315dcba57c5bd9864110d7021486cc.png)

the configuration is simple, and the GeoLIte2-city.mmdb database is the latest.

```
geoip {
    source => "clientip"
    database => "/usr/data/geolite2/GeoLite2-City.mmdb"
    fields => ["region_name"]
  }
```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 16, 2020, 10:01am UTC](https://discuss.elastic.co/t/geoip-lookup-failed/241414/2 "2020-07-16T10:01:18Z")

</div>

It could be the database doesn't have that IP listed, it does happen from time to time.

---

<div class="post-metadata">

**Author:** ![Alex\_Liu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_liu/32/47533_2.png) [@Alex\_Liu](https://discuss.elastic.co/u/Alex_Liu)\
**Post date:** [July 16, 2020, 2:07pm UTC](https://discuss.elastic.co/t/geoip-lookup-failed/241414/3 "2020-07-16T14:07:13Z")

</div>

yes, you're correct, the first ip address's info is not as accurate as the second one in GeoLite2 Database.

```
$ /usr/bin/python3 /home/alex/pytest/ipquery.py
geoip2.models.City({'continent': {'code': 'AS', 'geoname_id': 6255147, 'names': {'de': 'Asien', 'en': 'Asia', 'es': 'Asia', 'fr': 'Asie', 'ja': 'アジア', 'pt-BR': 'Ásia', 'ru': 'Азия', 'zh-CN': '亚洲'}}, 'country': {'geoname_id': 1814991, 'iso_code': 'CN', 'names': {'de': 'China', 'en': 'China', 'es': 'China', 'fr': 'Chine', 'ja': '中国', 'pt-BR': 'China', 'ru': 'Китай', 'zh-CN': '中国'}}, 'location': {'accuracy_radius': 50, 'latitude': 34.7725, 'longitude': 113.7266, 'time_zone': 'Asia/Shanghai'}, 'registered_country': {'geoname_id': 1814991, 'iso_code': 'CN', 'names': {'de': 'China', 'en': 'China', 'es': 'China', 'fr': 'Chine', 'ja': '中国', 'pt-BR': 'China', 'ru': 'Китай', 'zh-CN': '中国'}}, 'traits': {'ip_address': '123.58.60.5', 'prefix_len': 18}}, ['en'])

# alex @ LAPTOP-FB6FQ8MU in ~ [21:57:21] 
$ /usr/bin/python3 /home/alex/pytest/ipquery.py
geoip2.models.City({'city': {'geoname_id': 1799722, 'names': {'de': 'Nantong', 'en': 'Nantong', 'fr': 'Nantong', 'ja': '南通市', 'pt-BR': 'Nantong', 'ru': 'Наньтун', 'zh-CN': '南通'}}, 'continent': {'code': 'AS', 'geoname_id': 6255147, 'names': {'de': 'Asien', 'en': 'Asia', 'es': 'Asia', 'fr': 'Asie', 'ja': 'アジア', 'pt-BR': 'Ásia', 'ru': 'Азия', 'zh-CN': '亚洲'}}, 'country': {'geoname_id': 1814991, 'iso_code': 'CN', 'names': {'de': 'China', 'en': 'China', 'es': 'China', 'fr': 'Chine', 'ja': '中国', 'pt-BR': 'China', 'ru': 'Китай', 'zh-CN': '中国'}}, 'location': {'accuracy_radius': 500, 'latitude': 32.0303, 'longitude': 120.8747, 'time_zone': 'Asia/Shanghai'}, 'registered_country': {'geoname_id': 1814991, 'iso_code': 'CN', 'names': {'de': 'China', 'en': 'China', 'es': 'China', 'fr': 'Chine', 'ja': '中国', 'pt-BR': 'China', 'ru': 'Китай', 'zh-CN': '中国'}}, 'subdivisions': [{'geoname_id': 1806260, 'iso_code': 'JS', 'names': {'en': 'Jiangsu', 'fr': 'Province de Jiangsu', 'zh-CN': '江苏省'}}], 'traits': {'ip_address': '112.85.231.147', 'prefix_len': 17}}, ['en'])
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 16, 2020, 5:51pm UTC](https://discuss.elastic.co/t/geoip-lookup-failed/241414/4 "2020-07-16T17:51:01Z")

</div>

The plugin ships with a database that probably dates from when the plugin was built. You could try downloading a current database from MaxMind and see if coverage for that IP has been added.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 13, 2020, 5:51pm UTC](https://discuss.elastic.co/t/geoip-lookup-failed/241414/5 "2020-08-13T17:51:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.