Issue with GeoIP location

Elastic Stack Logstash
1

Hi,

I am forwarding apache log to logstash using filebeat and using GeoLite.dat database for geoip. The configuration file is:

input {
beats {
port => "5044"
}
}

The filter part of this file is commented out to indicate that it is

optional.

filter {
grok {
match => { "message" => "%{COMBINEDAPACHELOG}"}
}
geoip {
source => "clientip"
target => "geoip"
database => "/etc/logstash/GeoLiteCity.dat"
add_field => [ "[geoip][coordinates]","%{[geoip][longitude]}"]
add_field => [ "[geoip][coordinates]","%{[geoip][latitude]}"]
}
mutate {
convert => [ "[geoip][coordinates]","float"]
}
}
output {
elasticsearch { protocol => "http" }

stdout { codec => rubydebug }

}

Capture_IP.JPG866×171 24.8 KB

The problem is with client ip and location. When we are searching location with Lat. & Long. it is showing China but when we search with clientip on url: https://www.iplocation.net/, it gives some other location.(In my case it is showing India)
Can any one please help me to resolve issue as i want accurate location on map

2

The one we use is free and is expected to be less than 100% accurate. You should pay for a more accurate database from Maxmind.

3

Thanks for the reply :slight_smile:
My config file is ok or need some cahnge?
Is there any other method to get accurate data?

4

From what I remember the GeoIP database that comes pre-installed doesn't update automatically. You have to download the newest database file from Maxmind's website. I believe they put out a new version once per month for the free version. The version you are using could be several years out of date.

I like to use this website for looking up IP's. The reason why is that it looks at several different GeoIP databases so you can see how much they differ.
https://www.iplocation.net/
For example I plugged in your IP from above. It actually shows the maxmind database as showing India. My guess is that the version of the geoIP database you have installed shows China, but if you were to download the newest version it would show India. Try updating the database and see if your results change.

I have a cron job similar to what is found in this stackoverflow answer that updates the database once per month.

5

@bhatch thanks :slight_smile: now we are getting more accurate data

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.