Auto update GeoLite DB

Elastic Stack Elasticsearch
1

Hello

Logstash logs following warnings/errors related to GeoLite:

failed to fetch ASN database {:exception=>"503 Service Unavailable"}

failed to fetch City database {:exception=>"503 Service Unavailable"}

The managed MaxMind GeoIP ASN database hasn't been synchronized in 43 days and will be removed in order to remain compliant with the MaxMind EULA.
Logstash is unable to get newer version from internet.
Please check the network settings and allow Logstash accesses the internet to download the latest database.
Alternatively you can switch to a self-managed GeoIP database service (xpack.geoip.download.endpoint),
or configure each plugin with a self-managed database which you can download from GeoLite Databases and Web Services | MaxMind Developer Portal

I found information concerning this: Geoip filter plugin | Logstash Plugins

What I did not find in the article is which url's need to be whitelisted for Logstash servers so the automatic download succeeds. Does anyone has more information?

Best regards

Christophe

2

503 would be issues with the Elastic endpoint providing the geoip downloads, unless you have anything between logstash and the internet, do you have any proxy or something else between logstash and the internet?

It is geoip.elastic.co, it is mentioned in this documention, but for some reason the plugin documentation does not reference it.

Defaults to https://geoip.elastic.co/v1/database