_geoip_lookup_failure

There is nothing that creates the [src] field before the geoip filter runs. That will result in the failure tag getting added.