Ow! I would argue that this is a bug. Most filters are a no-op if the source field does not exist. However, the geoip filter takes a different approach. If the field lookup fails then the java code returns false. The ruby code either decorates the event or tags it for failure. There is no no-op path. I think the ruby code should duplicate the source existence check.