# \_geoip\_lookup\_failure

**URL:** <https://discuss.elastic.co/t/geoip-lookup-failure/362491>\
**Category:** Logstash\
**Created:** [July 3, 2024, 7:30pm UTC](https://discuss.elastic.co/t/geoip-lookup-failure/362491 "2024-07-03T19:30:48Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 3, 2024, 7:44pm UTC](https://discuss.elastic.co/t/geoip-lookup-failure/362491/2 "2024-07-03T19:44:16Z")

</div>

There is nothing that creates the [src] field before the geoip filter runs. [That will result](https://discuss.elastic.co/t/geoip-lookup-failure-though-all-geoip-fields-are-populated/195267/12) in the failure tag getting added.

---

_[View the full topic](https://discuss.elastic.co/t/geoip-lookup-failure/362491)._