# Source IP Geoip

**URL:** <https://discuss.elastic.co/t/source-ip-geoip/273339>\
**Category:** Kibana\
**Created:** [May 18, 2021, 7:21pm UTC](https://discuss.elastic.co/t/source-ip-geoip/273339 "2021-05-18T19:21:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pacous](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pacous/32/86117_2.png) [@Pacous](https://discuss.elastic.co/u/Pacous)\
**Post date:** [May 18, 2021, 7:21pm UTC](https://discuss.elastic.co/t/source-ip-geoip/273339/1 "2021-05-18T19:21:54Z")

</div>

Hello,

I collect the fortigate events.  
I configured the geoip plugin in logstash.  
The visualization of sources before configuring the plugin is different after configuring the plugin.  
Please find the difference below:

 ![ip_after](https://us1.discourse-cdn.com/elastic/original/3X/1/b/1b461128199908bc51dff735aee344a1ae278a1b.png)  
 ![ip_before](https://us1.discourse-cdn.com/elastic/original/3X/b/c/bc59a060775fcc1f23a17a62ef83e02055cf0097.png)  
 ![src_after](https://us1.discourse-cdn.com/elastic/original/3X/f/0/f0dafa710cd8e20ef0dd3ae002e94e314065db26.png)  
 ![src_before](https://us1.discourse-cdn.com/elastic/original/3X/1/0/10c964d3bca6965f8816ad0b724add9e1bd1a918.png)

Can you explain to me why the list of ip before configuring the plugin is different from the list linked to Geoip?  
Can you explain to me why we have UnitedStates which produces the most events on the fortigate logs and Amsterdam is in fourth position. And on the Geoip\_timezone, is Amsterdam which produces the most events and UnitedStates is in fourth position?

Regards,

---

<div class="post-metadata">

**Author:** ![thomasneirynck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasneirynck/32/23313_2.png) [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\
**Post date:** [May 19, 2021, 3:07pm UTC](https://discuss.elastic.co/t/source-ip-geoip/273339/2 "2021-05-19T15:07:51Z")

</div>

I think the first one seems to be looking at timezones. The second at geographic location.

My hunch is:

in the second screenshot, it shows northamerica.unitedstates on top (it collects traffic from 4 timezones).

But I'm not quite sure how the timezone-data is generated (is that part of the original logs?)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 16, 2021, 3:08pm UTC](https://discuss.elastic.co/t/source-ip-geoip/273339/3 "2021-06-16T15:08:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.