# Manually adding geoip data fails

**URL:** <https://discuss.elastic.co/t/manually-adding-geoip-data-fails/99562>\
**Category:** Logstash\
**Created:** [September 6, 2017, 10:53am UTC](https://discuss.elastic.co/t/manually-adding-geoip-data-fails/99562 "2017-09-06T10:53:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![admlko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/admlko/32/21787_2.png) [@admlko](https://discuss.elastic.co/u/admlko)\
**Post date:** [September 6, 2017, 10:53am UTC](https://discuss.elastic.co/t/manually-adding-geoip-data-fails/99562/1 "2017-09-06T10:53:24Z")

</div>

Hi,

I would like to rewrite/add geoip data manually to events to/from 172.40.40.0/24 and 172.40.41.0/24 subnets.  
The filter is configured like this:

```
# Geo-IP lookup
if [src_ip] {
  # Fix public IP subnets
  if [src_ip] =~ /^172\.40\.40/ or [src_ip] =~ /^172\.40\.41/ {
    mutate { update => { "[src_geoip][timezone]" => "Continent/City" } }
    mutate { update => { "[src_geoip][city_name]" => "City" } }
    mutate { update => { "[src_geoip][continent_code]" => "Continent" } }
    mutate { update => { "[src_geoip][country_name]" => "Country" } }
    mutate { update => { "[src_geoip][country_code2]" => "XX" } }
    mutate { update => { "[src_geoip][country_code3]" => "XX" } }
    mutate { update => { "[src_geoip][postal_code]" => "00000" } }
    mutate { update => { "[src_geoip][region_code]" => "00" } }
    mutate { update => { "[src_geoip][region_name]" => "Region Name" } }
    mutate { remove_field => ["[src_geoip][location]" ] }
    mutate { add_field => { "[src_geoip][location]" => "XX.XXXXXX" } }
    mutate { add_field => { "[src_geoip][location]" => "XX.XXXXXX" } }
    mutate { convert => ["[src_geoip][location]", "float" ] }
    mutate { update => ["[src_geoip][latitude]", XX.XXXXXX ] }
    mutate { convert => ["[src_geoip][latitude]", "float" ] }
    mutate { update => ["[src_geoip][longitude]", XX.XXXXXX ] }
    mutate { convert => ["[src_geoip][longitude]", "float" ] }
  }
  else {
    geoip {
      source => "src_ip"
      target => "src_geoip"
      tag_on_failure => ["src_private"]
    }
  }
}
if [dst_ip] {
  # Fix public IP subnets
  if [dst_ip] =~ /^172\.40\.40/ or [dst_ip] =~ /^172\.40\.41/ {
    mutate { update => { "[dst_geoip][timezone]" => "Continent/City" } }
    mutate { update => { "[dst_geoip][city_name]" => "City" } }
    mutate { update => { "[dst_geoip][continent_code]" => "Continent" } }
    mutate { update => { "[dst_geoip][country_name]" => "Country" } }
    mutate { update => { "[dst_geoip][country_code2]" => "XX" } }
    mutate { update => { "[dst_geoip][country_code3]" => "XX" } }
    mutate { update => { "[dst_geoip][postal_code]" => "00000" } }
    mutate { update => { "[dst_geoip][region_code]" => "00" } }
    mutate { update => { "[dst_geoip][region_name]" => "Region Name" } }
    mutate { remove_field => ["[dst_geoip][location]" ] }
    mutate { add_field => { "[dst_geoip][location]" => "XX.XXXXXX" } }
    mutate { add_field => { "[dst_geoip][location]" => "XX.XXXXXX" } }
    mutate { convert => ["[dst_geoip][location]", "float" ] }
    mutate { update => ["[dst_geoip][latitude]", XX.XXXXXX ] }
    mutate { convert => ["[dst_geoip][latitude]", "float" ] }
    mutate { update => ["[dst_geoip][longitude]", XX.XXXXXX ] }
    mutate { convert => ["[dst_geoip][longitude]", "float" ] }
  }
  else {
    geoip {
      source => "dst_ip"
      target => "dst_geoip"
 	  tag_on_failure => ["dst_private"]
    }
  }
}

```

So, if source or destination IP address hits the 172.40.40.0/24 or 172.40.41.0/24 subnets, manually rewrite the location. If not, use geoip lookup.  
But if I apply this, I lose all events to and from those subnets. It acts like a drop {} filter!

Can anyone explain why this happens and how can I fix this?

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 4, 2017, 10:53am UTC](https://discuss.elastic.co/t/manually-adding-geoip-data-fails/99562/2 "2017-10-04T10:53:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.