# Logstash Geoip plugin **URL:** \ **Category:** Logstash\ **Created:** [March 8, 2022, 6:55am UTC](https://discuss.elastic.co/t/logstash-geoip-plugin/299044 "2022-03-08T06:55:19Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![RAM\_NATHAN](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ram_nathan/32/50393_2.png) [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Post date:** [March 8, 2022, 6:55am UTC](https://discuss.elastic.co/t/logstash-geoip-plugin/299044/1 "2022-03-08T06:55:19Z")
Hi Im using Logstash Geoip Plugin as below ```auto geoip { source => "sourceIP" target => "geoIP" add_field => { "countryCode" => "%{[geoIP][country_code2]}" } } ``` But at times, this plugin result doesnt have country\_code2 as below ```auto "geoIP": { "ip": " **.**. **.**", "location": { "lat": **, "lon": * }, "longitude": *, "latitude": **, "timezone": "Europe/Vaduz", "continent_code": "EU" } ``` So my parsing is failed for countryCode. How to fix this? This is occurring only for few IP's, not all. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 8, 2022, 5:59pm UTC](https://discuss.elastic.co/t/logstash-geoip-plugin/299044/2 "2022-03-08T17:59:37Z")
> [@RAM\_NATHAN](#): > > How to fix this? How do you want to fix it? One option would be to make the add\_field conditional. ``` if [geoIP][country_code2] { mutate { add_field => { "countryCode" => "%{[geoIP][country_code2]}" } } } ``` but you might want something else. ---
**Author:** ![RAM\_NATHAN](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ram_nathan/32/50393_2.png) [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Post date:** [March 9, 2022, 3:12am UTC](https://discuss.elastic.co/t/logstash-geoip-plugin/299044/3 "2022-03-09T03:12:40Z")
That is what I did. But I need to know why its not able to fetch country code for selective Ip's. Is it a bug? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 9, 2022, 4:04am UTC](https://discuss.elastic.co/t/logstash-geoip-plugin/299044/4 "2022-03-09T04:04:53Z")
> [@RAM\_NATHAN](#): > > need to know why its not able to fetch country code for selective Ip's By far the most likely explanation is that the country code is missing from the database. The logstash filter will return whatever the MaxMind .getIsoCode method returns. You can lookup an address on the MaxMind web site [here](https://www.maxmind.com/en/geoip2-precision-demo). Note that it may show a country code and an accuracy radius. If the longitude and latitude place an IP address in (let's say) Belgium, with a 1000 km accuracy that could be in any one of a dozen or more countries. A lot of free GeoIP data are basically warmed over whois data. Many IP addresses will resolve to the location of the corporate headquarters of a cable company that has long since been rolled up by a larger one. Similarly a lot of web sites appear to be in Cambridge, MA, because there is a large CDN headquartered there. I have seen other hot-spots that make no sense to me at all. Less of a problem now is what to do with unallocated addresses. If a block was assigned to RIPE (the European registry) but not delegated to a customer, where is an IP in that block? RIPE's HQ is in Amsterdam, and a surprisingly large number of address resolve to that city. ---
**Author:** ![RAM\_NATHAN](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ram_nathan/32/50393_2.png) [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Post date:** [March 9, 2022, 9:09am UTC](https://discuss.elastic.co/t/logstash-geoip-plugin/299044/5 "2022-03-09T09:09:21Z")
> [@Badger](#): > > orate headquarters of a cable company that has long since been rolled up by a larger one. Thanks for the update. I'm getting COUNTRYCODE as US in MaxMind portal,but accuracy is 1000 Km. Was that the issue? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 9, 2022, 6:15pm UTC](https://discuss.elastic.co/t/logstash-geoip-plugin/299044/6 "2022-03-09T18:15:13Z")
> [@RAM\_NATHAN](#): > > Was that the issue? Maybe. It is really a question for MaxMind. logstash just uses what their API returns. ---
**Author:** ![RAM\_NATHAN](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ram_nathan/32/50393_2.png) [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Post date:** [March 10, 2022, 6:14am UTC](https://discuss.elastic.co/t/logstash-geoip-plugin/299044/7 "2022-03-10T06:14:37Z")
Right now, there is no real fix.correct?. Can I tune some MaxMind config to get rid of this issue? or Can I upgrade MaxMind , if that is possible? ---
**Author:** ![RAM\_NATHAN](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ram_nathan/32/50393_2.png) [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Post date:** [March 16, 2022, 3:12am UTC](https://discuss.elastic.co/t/logstash-geoip-plugin/299044/8 "2022-03-16T03:12:54Z")
Can I use anyother db instead of maxmind? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 16, 2022, 3:39am UTC](https://discuss.elastic.co/t/logstash-geoip-plugin/299044/9 "2022-03-16T03:39:27Z")
The filter imports a lot of MaxMind classes to interpret the database. If anyone else has the ability to create MaxMind compatible databases then I would expect they would work, but I doubt anyone else actually does that. I believe I have seen blog posts about how to do it, but I also doubt anyone is doing that with high quality data. ---
**Author:** ![RAM\_NATHAN](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ram_nathan/32/50393_2.png) [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Post date:** [March 16, 2022, 4:38am UTC](https://discuss.elastic.co/t/logstash-geoip-plugin/299044/10 "2022-03-16T04:38:28Z")
Thanks for the update. what would be the solution in this case? We need MaxMind to fix this or upgrade maxmind? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 16, 2022, 12:55pm UTC](https://discuss.elastic.co/t/logstash-geoip-plugin/299044/11 "2022-03-16T12:55:53Z")
It would be up to MaxMind to fix this. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 13, 2022, 12:55pm UTC](https://discuss.elastic.co/t/logstash-geoip-plugin/299044/12 "2022-04-13T12:55:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.