# Logstash-oss:7.4.0 geoip reports wrong lat/lon **URL:** \ **Category:** Logstash\ **Created:** [November 23, 2019, 6:37pm UTC](https://discuss.elastic.co/t/logstash-oss-7-4-0-geoip-reports-wrong-lat-lon/209161 "2019-11-23T18:37:14Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Long\_Thai](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/long_thai/32/55806_2.png) [@Long\_Thai](https://discuss.elastic.co/u/Long_Thai)\ **Post date:** [November 23, 2019, 6:37pm UTC](https://discuss.elastic.co/t/logstash-oss-7-4-0-geoip-reports-wrong-lat-lon/209161/1 "2019-11-23T18:37:15Z")
I found some incorrect results when performing geoip of IP addresses through the **geoip** filter in Logsstash-oss:7.4.0. Two IP address in question are: **171.246.59.245** **123.30.237.63** From logstash both IPs have the same latitude/longitude 16/106 which is not even in Vietnam (Laos) geoip.ip 42.117.130.155 geoip.ip 123.30.237.63 geoip.country\_name Vietnam geoip.location { "lat": 16, "lon": 106 } According to [https://www.maxmind.com/en/geoip-demo](https://www.maxmind.com/en/geoip-demo) or [https://www.iplocation.net](https://www.iplocation.net), these IPs do not have the same lat/lon as reported by logstash. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [November 23, 2019, 6:51pm UTC](https://discuss.elastic.co/t/logstash-oss-7-4-0-geoip-reports-wrong-lat-lon/209161/2 "2019-11-23T18:51:07Z")
Free geoip data is generally not very good. You could try updating the database used by the geoip filter with the latest free database from maxmind, but it may not help. ---
**Author:** ![Long\_Thai](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/long_thai/32/55806_2.png) [@Long\_Thai](https://discuss.elastic.co/u/Long_Thai)\ **Post date:** [November 23, 2019, 7:27pm UTC](https://discuss.elastic.co/t/logstash-oss-7-4-0-geoip-reports-wrong-lat-lon/209161/3 "2019-11-23T19:27:52Z")
Thanks. I performed logstash-plugin update but logstash-filter-geoip was already up-to-date so it was not updated. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [November 24, 2019, 3:14pm UTC](https://discuss.elastic.co/t/logstash-oss-7-4-0-geoip-reports-wrong-lat-lon/209161/4 "2019-11-24T15:14:21Z")
I was suggesting that you go to [maxmind.com](http://maxmind.com) and download the latest available db. ---
**Author:** ![Long\_Thai](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/long_thai/32/55806_2.png) [@Long\_Thai](https://discuss.elastic.co/u/Long_Thai)\ **Post date:** [November 24, 2019, 9:48pm UTC](https://discuss.elastic.co/t/logstash-oss-7-4-0-geoip-reports-wrong-lat-lon/209161/5 "2019-11-24T21:48:09Z")
I have downloaded the latest file GeoLite2-City.mmdb and comparing with the original database that comes with logstash-oss:7.4.2, there is no difference for the IPs that are in question. -rw-rw-r-- 1 logstash root 61356751 Oct 28 22:53 /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-6.0.3-java/vendor/GeoLite2-City.mmdb -rw-r--r-- 1 root root 62852205 Nov 24 15:41 /data/data/GeoLite2-City.mmdb However, if I follow this link [https://www.elastic.co/blog/geoip-in-the-elastic-stack](https://www.elastic.co/blog/geoip-in-the-elastic-stack) and replace the IPs in question, I find that the lat/lon has correct values. Not sure what Geoip database it is using ? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 22, 2019, 9:48pm UTC](https://discuss.elastic.co/t/logstash-oss-7-4-0-geoip-reports-wrong-lat-lon/209161/6 "2019-12-22T21:48:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.