The GeoIP information are extracted from the destination IP only (I think that this is caused by the logstash configuration, which logs the geoip result with the same key for source and destination IPs). In my opinion, these informations should be divided in geoip_src and geoip_dest.

My setup is SELKS with a secondary NIC for passive interception (the NIC is linked to a SPAN/mirror port in the switch)