# Possible bug with geoip filter **URL:** \ **Category:** Logstash\ **Created:** [July 5, 2017, 2:18pm UTC](https://discuss.elastic.co/t/possible-bug-with-geoip-filter/91921 "2017-07-05T14:18:42Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![jclose](https://avatars.discourse-cdn.com/v4/letter/j/df705f/32.png) [@jclose](https://discuss.elastic.co/u/jclose)\ **Post date:** [July 5, 2017, 2:18pm UTC](https://discuss.elastic.co/t/possible-bug-with-geoip-filter/91921/1 "2017-07-05T14:18:42Z")
I was looking at some of my logs this morning, and across all of my nodes, I am seeing an occasional log line that is consitent: > [2017-07-05T11:00:04,760][DEBUG][o.e.a.b.TransportShardBulkAction] [ES102] [log-source-2017.07.05.11][3] failed to execute bulk item (index) BulkShardRequest [[log-source-2017.07.05.11][3]] containing [91] requests > java.lang.IllegalArgumentException: mapper [source\_geoip.dma\_code] of different type, current\_type [text], merged\_type [long] This is happening across all of the index types, but it is a rare occasion. So maybe 5-6 times in the last few days, per node. Considering we are running the `geoip` call 30k times a second, it is rare. But it does exist. It looks like the call to `geoip` sometimes produces a value that is not a 'long' value for the `dma_code` value inside of the `geoip` value, sometimes producing a 'text'. This, in return, is causing a bulk submit to fail. Has anyone else seen this, and how do we go about confirming this as a bug? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 2, 2017, 2:29pm UTC](https://discuss.elastic.co/t/possible-bug-with-geoip-filter/91921/2 "2017-08-02T14:29:21Z")
Closed on August 2, 2017, 2:29pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.