# Logstash trying to replace geoip.country\_name

**URL:** <https://discuss.elastic.co/t/logstash-trying-to-replace-geoip-country-name/104812>\
**Category:** Logstash\
**Created:** [October 22, 2017, 6:05pm UTC](https://discuss.elastic.co/t/logstash-trying-to-replace-geoip-country-name/104812 "2017-10-22T18:05:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jojo58](https://avatars.discourse-cdn.com/v4/letter/j/d26b3c/32.png) [@jojo58](https://discuss.elastic.co/u/jojo58)\
**Post date:** [October 22, 2017, 6:05pm UTC](https://discuss.elastic.co/t/logstash-trying-to-replace-geoip-country-name/104812/1 "2017-10-22T18:05:23Z")

</div>

I noticed that the naming conventions between the kibana region map and the logstash geoip plugin aren't the same. And when i try to visualize my data i get errors from the region map telling me that it can't find "Republic of Korea", because it's named "Korea, Republic of" on the region map.  
So i'm trying to use the mutate filter to change the geoip.country\_name for odd cases like those.

Here's my filter config:  
filter {  
if [type] == "ossec\_alert\_log" {  
json {  
source =\> "message"  
}  
geoip {  
source =\> "srcip"  
}  
}  
else if [type] == "nginx\_access\_log" {  
grok {  
patterns\_dir =\> "/etc/logstash/patterns"  
match =\> { "message" =\> "%{NGINX\_ACCESS}" }  
remove\_tag =\> ["\_grokparsefailure"]  
add\_tag =\> ["nginx\_access"]  
}  
geoip {  
source =\> "clientip"  
}  
}  
if [geoip][country\_name] == "Republic of Korea" {  
mutate {  
replace =\> { "%{[geoip][country\_name]}" =\> "Korea, Republic of" }  
}  
}  
}

As you can see i try to replace Republic of Korea with Korea, Republic of, but the logs in Kibana still say Republic of Korea.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 25, 2017, 3:44am UTC](https://discuss.elastic.co/t/logstash-trying-to-replace-geoip-country-name/104812/2 "2017-10-25T03:44:00Z")

</div>

What is the field mapped as?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 22, 2017, 3:44am UTC](https://discuss.elastic.co/t/logstash-trying-to-replace-geoip-country-name/104812/3 "2017-11-22T03:44:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.