We use multiple GeoIP databases. We're using GeoIP2-City to get location information, and GeoIP-ISP to get as.number and as.organization.name. However, I cannot load the provided MaxMind GeoIP2-ISP.mmdb.
The docs mention being able to use multiple database files for this information. The old GeoIP-ASN was replaced with GeoIP2-ISP, so this should be supported. Is there a way to get past this. I've found 2 other discussions asking this question on this forum with no answer. Maybe, the third time is a charm and someone familiar with the product has the magic incantation.
Curious... I looked a bit where does it say in the elastic docs that GeoIP2-ISP is supported (not saying we don't I just don't see it in our docs).
From the MaxMind site the format of the ISP database is different than the ASN database.
And the docs appear to say
You can also use custom city, country, and ASN .mmdb files. These files must be uncompressed and use the respective -City.mmdb , -Country.mmdb , or -ASN.mmdb extensions.
I am trying to check, but I am thinking that is not supported at the moment, because it is not actually a GEOIP lookup, i.e. it does not contain a lat / lon which is expected (i.e. the GEO portion of the equation) it just has ISP / ASN info so perhaps it is more of a standard enrich lookup.
If I get a chance I will look.
Update.. interesting yes ASN contains no geo data... I will look more, it could be it is simply a different format / set of columns.
Update 2 : Looks like a flat out feature request, not currently supported.
The path to MaxMind’s database file that Logstash should use. The default database is GeoLite2-City. GeoLite2-City, GeoLite2-Country, GeoLite2-ASN are the free databases from MaxMind that are supported. GeoIP2-City, GeoIP2-ISP, GeoIP2-Country are the commercial databases from MaxMind that are supported.
I purchased a GeoIP2-ISP.mmdb and tried, it is not currently supported (AFAICT) I also tried to build a direct enrich processor from the ISP CSV but that did not work because of the IP range search is not supported (that would have been a good workaround)
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.