# Logstash geoip filter no city name

**URL:** <https://discuss.elastic.co/t/logstash-geoip-filter-no-city-name/165182>\
**Category:** Logstash\
**Created:** [January 22, 2019, 8:29am UTC](https://discuss.elastic.co/t/logstash-geoip-filter-no-city-name/165182 "2019-01-22T08:29:33Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Joel-Costamagna](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joel-costamagna/32/40059_2.png) [@Joel-Costamagna](https://discuss.elastic.co/u/Joel-Costamagna)\
**Post date:** [January 22, 2019, 8:29am UTC](https://discuss.elastic.co/t/logstash-geoip-filter-no-city-name/165182/1 "2019-01-22T08:29:33Z")

</div>

Hello,  
I try to use geoip for my source adresse, but sometimes it shows the correct city name, sometimes it shows a wrong location and there is no geoip.city\_name field. However if i look up the ip i the maxmind demo ([https://www.maxmind.com/en/geoip2-precision-demo](https://www.maxmind.com/en/geoip2-precision-demo)) it shows the right location. How can I solve the problem ? is it possible to put "other" in the field so that it's never empty ?

here is the relevant part of config :

```
  1 filter {
  2 if [syslog_program] =~ "filterlog" {
  3 grok {
  4 match => ["syslog_message", "(%{NONNEGINT:rule_number})?\,(%{NONNEGINT:sub_rule_number})?\,(%{DATA:anchor})?\,(%{NONNEGINT:tracker_id})?\,%{DATA:interface}\,%{DATA:reason}\,%{DATA:action}\,%{ DATA:direction}\,%{NONNEGINT:ip_version},%{GREEDYDATA:sub_msg}"]
  5 }
  6 if [ip_version] =~ "4" {
  7 csv {
  8 source => [sub_msg]
  9 columns => ["ipv4_tos","ipv4_ecn","ipv4_ttl","ipv4_id","ipv4_offset", "ipv4_flags","ipv4_protocol_id","ipv4_protocol","ipv4_protocol_length","source_ip","destination_ip","source_port","destin ation_port","data_length","tcp_flags","sequence_number","ack","window","urg","options"]
 10 separator => ","
 11 }
 12 }
 13 if [ip_version] =~ "6" {
 14 csv {
 15 source => [sub_msg]
 16 columns => ["class","flow_label","hop_limit","protocol","protocol_id","length","source_ip","destination_ip","source_port","destination_port","data_length","tcp_flags","sequence_number","ack", "window","urg","options"]
 17 separator => ","
 18 }
 19 }
 20 mutate {
 21 convert => ["destination_port", "integer"]
 22 convert => ["source_port", "integer"]
 23 convert => ["ip_version", "integer"]
 24 convert => ["data_length", "integer"]
 25 convert => ["ipv4_protocol_length", "integer"]
 26 convert => ["ipv4_ttl", "integer"]
 27 convert => ["rule_number", "integer"]
 28 replace => { "type" => "firewall" }
 29 add_tag=> ["pfsense"]
 30 remove_field => ["sub_msg", "syslog_message"]
 31 }
 32 geoip {
 33 source => source_ip
 34 fields => ["city_name", "location"]
 35 database => "/etc/logstash/GeoLite2-City.mmdb"
 36 tag_on_failure => ["geoip_failed"] 
 37 }
 38 }
 39 }
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 22, 2019, 12:51pm UTC](https://discuss.elastic.co/t/logstash-geoip-filter-no-city-name/165182/2 "2019-01-22T12:51:55Z")

</div>

Something like

```
if ! [geoip][city_name] {
    mutate { add_field => { "[geoip][city_name]" => "other" } }
}

```

perhaps?

---

<div class="post-metadata">

**Author:** ![Joel-Costamagna](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joel-costamagna/32/40059_2.png) [@Joel-Costamagna](https://discuss.elastic.co/u/Joel-Costamagna)\
**Post date:** [January 22, 2019, 1:06pm UTC](https://discuss.elastic.co/t/logstash-geoip-filter-no-city-name/165182/3 "2019-01-22T13:06:55Z")

</div>

thanks, that works as a temporary workaround, but i don't understand why geoip does not create the city\_name field, since it have a location field with correct coordinates.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 22, 2019, 1:10pm UTC](https://discuss.elastic.co/t/logstash-geoip-filter-no-city-name/165182/4 "2019-01-22T13:10:32Z")

</div>

My guess is that the database is [missing](https://github.com/logstash-plugins/logstash-filter-geoip/blob/7c8356e8713b39d4b3c925b85271d64dd9521f8f/src/main/java/org/logstash/filters/GeoIPFilter.java#L210) the city name.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 19, 2019, 1:11pm UTC](https://discuss.elastic.co/t/logstash-geoip-filter-no-city-name/165182/5 "2019-02-19T13:11:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.