# GeoIP working strange after update

**URL:** <https://discuss.elastic.co/t/geoip-working-strange-after-update/312505>\
**Category:** Elasticsearch\
**Created:** [August 19, 2022, 9:15pm UTC](https://discuss.elastic.co/t/geoip-working-strange-after-update/312505 "2022-08-19T21:15:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alexander\_A](https://avatars.discourse-cdn.com/v4/letter/a/9d8465/32.png) [@Alexander\_A](https://discuss.elastic.co/u/Alexander_A)\
**Post date:** [August 19, 2022, 9:15pm UTC](https://discuss.elastic.co/t/geoip-working-strange-after-update/312505/1 "2022-08-19T21:15:58Z")

</div>

After GeoIP Update using [geoip.elastic.co](http://geoip.elastic.co) we see strange behavior country for ip 1.1.1.1 not detected and organization\_name became "CLOUDFLARENET" instead of "Cloudflare, Inc".  
When we use simulate API we get old data (country and format "Cloudflare, Inc") which is completely differ from what we get in index using the same ingest pipeline.  
ES version 7.17  
Please help if you have any ideas what is going on.

---

<div class="post-metadata">

**Author:** ![Alexander\_A](https://avatars.discourse-cdn.com/v4/letter/a/9d8465/32.png) [@Alexander\_A](https://discuss.elastic.co/u/Alexander_A)\
**Post date:** [August 19, 2022, 9:50pm UTC](https://discuss.elastic.co/t/geoip-working-strange-after-update/312505/3 "2022-08-19T21:50:36Z")

</div>

Seems I have found an answer why simulate pipeline returns old data - [How to update the GeoIP Databases for Elastic Ingest Pipelines - #3 by nverrill](https://discuss.elastic.co/t/how-to-update-the-geoip-databases-for-elastic-ingest-pipelines/274259/3)

---

<div class="post-metadata">

**Author:** ![Alexander\_A](https://avatars.discourse-cdn.com/v4/letter/a/9d8465/32.png) [@Alexander\_A](https://discuss.elastic.co/u/Alexander_A)\
**Post date:** [August 23, 2022, 6:10pm UTC](https://discuss.elastic.co/t/geoip-working-strange-after-update/312505/4 "2022-08-23T18:10:48Z")

</div>

In our case kibana points to dedicated coordinating nodes and after updating geoip datadase using [geoip.elastic.co](http://geoip.elastic.co) we've got geoip database updated on data nodes and ingest nodes only.  
Coordinating nodes haven't been updated thats why kibana simulate API return old data.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 20, 2022, 6:11pm UTC](https://discuss.elastic.co/t/geoip-working-strange-after-update/312505/5 "2022-09-20T18:11:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.