Please also post your updated pipeline rule again. Here is a pretty detailed discussion of pitfalls with geoip: