# Logstash Filters and Geoip database option **URL:** \ **Category:** Logstash\ **Created:** [April 1, 2016, 6:17pm UTC](https://discuss.elastic.co/t/logstash-filters-and-geoip-database-option/46090 "2016-04-01T18:17:11Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![tlv324](https://avatars.discourse-cdn.com/v4/letter/t/46a35a/32.png) [@tlv324](https://discuss.elastic.co/u/tlv324)\ **Post date:** [April 1, 2016, 6:17pm UTC](https://discuss.elastic.co/t/logstash-filters-and-geoip-database-option/46090/1 "2016-04-01T18:17:11Z")
I want to be able to use a more updated version of the GeoLiteCity Database. However, when running Logstash with this configuration I get what seems to be a permissions error and I'm not sure how to fix that because I'm running Logstash as an admin. My second question pertains to the if statements within the filter. I want to use the IPv4 database if the ipAddress that I have is obviously of that type and same for IPv6. However, whenever I run Logstash I am unable to get the IPv6 addresses to be properly recognized and it always goes into the else statement. Could someone help me in determining where I am going wrong with my if statements. I posted the filter option from my configuration file below. `filter { if ([Payload_ipAddress] =~ /:/ ){ geoip { source => "Payload_ipAddress" target => "geoip" database => "c:/Logstash/GeoLiteCityv6" add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ] add_field => ["[geoip][coordinates]", "%{[geowhich ip][latitude]}"] } mutate { convert => ["[geoip][coordinates]", "float"] } } else { geoip { source => "Payload_ipAddress" target => "geoip" database => "c:/Logstash/GeoLiteCityIPv4" add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ] add_field => ["[geoip][coordinates]", "%{[geowhich ip][latitude]}" ] } mutate { convert => ["[geoip][coordinates]", "float"] } } mutate { remove_field => ["@timestamp", "@version"] } }` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 3, 2016, 2:13am UTC](https://discuss.elastic.co/t/logstash-filters-and-geoip-database-option/46090/2 "2016-04-03T02:13:53Z")
> [@tlv324](#): > > I want to be able to use a more updated version of the GeoLiteCity Database. However, when running Logstash with this configuration I get what seems to be a permissions error and I'm not sure how to fix that because I'm running Logstash as an admin. Providing more details on this would be helpful. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 3, 2016, 2:14am UTC](https://discuss.elastic.co/t/logstash-filters-and-geoip-database-option/46090/3 "2016-04-03T02:14:19Z")
> [@tlv324](#): > > However, whenever I run Logstash I am unable to get the IPv6 addresses LS doesn't understand IPv6 at this point. ---
**Author:** ![tlv324](https://avatars.discourse-cdn.com/v4/letter/t/46a35a/32.png) [@tlv324](https://discuss.elastic.co/u/tlv324)\ **Post date:** [April 15, 2016, 4:46pm UTC](https://discuss.elastic.co/t/logstash-filters-and-geoip-database-option/46090/4 "2016-04-15T16:46:03Z")
> [@warkolm](#): > > Providing more details on this would be helpful. Of course, I wasn't entirely sure how to phrase my meaning and my environment is now different so I don't have the exact error message anymore. I will try to replicate it and post and update to this ---
**Author:** ![tlv324](https://avatars.discourse-cdn.com/v4/letter/t/46a35a/32.png) [@tlv324](https://discuss.elastic.co/u/tlv324)\ **Post date:** [April 15, 2016, 4:48pm UTC](https://discuss.elastic.co/t/logstash-filters-and-geoip-database-option/46090/5 "2016-04-15T16:48:57Z")
> [@warkolm](#): > > LS doesn't understand IPv6 at this point. Okay, I know I had seen some people using filters to determine if it was IPv6 and then if it was they would use the beta version of GeoLiteCity's IPv6 database but I have been unable to get any of these to work, because in my case it defaults to the else statement and then throws the permission error ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:02am UTC](https://discuss.elastic.co/t/logstash-filters-and-geoip-database-option/46090/6 "2017-07-06T05:02:02Z")