# IP2location In place of GeoIP
**URL:** https://discuss.elastic.co/t/ip2location-in-place-of-geoip/135210
**Category:** Elasticsearch
**Created:** [June 9, 2018, 4:49am UTC](https://discuss.elastic.co/t/ip2location-in-place-of-geoip/135210 "2018-06-09T04:49:35Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@bruno-d](https://discuss.elastic.co/u/bruno-d)
#### Post date: [June 9, 2018, 4:49am UTC](https://discuss.elastic.co/t/ip2location-in-place-of-geoip/135210/1 "2018-06-09T04:49:35Z")
Hey,
I recently open a thread on the demand to move from GeoIP to IP2location (see [GeoIP Lite EOL pipeline filter](https://discuss.elastic.co/t/geoip-lite-eol-pipeline-filter/121369)) and i am now trying. How ever, i failed in my uses cases. _I use the GeoIp pipeline filter to fill the GeoIP values from an IP address extracted from syslog-events_. I just realised that a logstash-plugin exists **but no elastisearch-plugin**. Hence a pipeline filter has no sense right ? It means that GeoIP pipeline filter was working but IP2location will not.
It should be a small task to create a similar ip2location plugin for elastisearch based on the GeoIP plugin right ? How do you see the task to do it ?
```
`sudo ./elasticsearch-plugin install elastisearch-filter-ip2location
ERROR: Unknown plugin elastisearch-filter-ip2location `
```
Thanks
---
### Author:  [@bruno-d](https://discuss.elastic.co/u/bruno-d)
#### Post date: [June 19, 2018, 4:15pm UTC](https://discuss.elastic.co/t/ip2location-in-place-of-geoip/135210/2 "2018-06-19T16:15:44Z")
😥 New try for the thread
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [June 19, 2018, 4:25pm UTC](https://discuss.elastic.co/t/ip2location-in-place-of-geoip/135210/3 "2018-06-19T16:25:43Z")
Since there is a Logstash plugin maintained by the company behind ip2location, why don't you do the processing in Logstash instead?
---
### Author:  [@bruno-d](https://discuss.elastic.co/u/bruno-d)
#### Post date: [June 20, 2018, 11:14am UTC](https://discuss.elastic.co/t/ip2location-in-place-of-geoip/135210/4 "2018-06-20T11:14:49Z")
Hi christian, thanks for challenging the idea. I did not run the process in logstash as the IP ( i would like info about) is extracted from a syslog messages transmit by my home router. The IP is then affected to a _private_ field by elastisearch and will be processed as input of the GeoIP filter. Example : I am looking after the character _SRC=_ :
```
kernel: Intrusion -> IN=ppp0.1 OUT= MAC= SRC=92.63.193.170
```
Once affected to the private field , I run the **GeoIP pipeline filter** on this private variable.
In this uses cases i did not know how to do it with ip2location. I also would like that we keep free this functionality. True, If the company behind ip2location is not an _engine_ on this then we can find another alternative too. no worries. agree. if we have to do something (as free personnal end user) then we can. thats' why i am asking ? all good. 👌
Regards
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 18, 2018, 11:15am UTC](https://discuss.elastic.co/t/ip2location-in-place-of-geoip/135210/5 "2018-07-18T11:15:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.