# Cannot Load MaxMind GeoIP2-ISP.mmdb **URL:** \ **Category:** Elasticsearch\ **Tags:** ingest-pipeline\ **Created:** [November 11, 2021, 10:23pm UTC](https://discuss.elastic.co/t/cannot-load-maxmind-geoip2-isp-mmdb/289027 "2021-11-11T22:23:42Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![reyjrar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/reyjrar/32/97040_2.png) [@reyjrar](https://discuss.elastic.co/u/reyjrar)\ **Post date:** [November 11, 2021, 10:23pm UTC](https://discuss.elastic.co/t/cannot-load-maxmind-geoip2-isp-mmdb/289027/1 "2021-11-11T22:23:43Z")
Hello, We use multiple GeoIP databases. We're using GeoIP2-City to get location information, and GeoIP-ISP to get as.number and as.organization.name. However, I cannot load the provided MaxMind `GeoIP2-ISP.mmdb`. ```auto { "description": "Adds geoip info for ECS documents", "processors": [ { "geoip": { "database_file": "GeoIP2-City.mmdb", "field": "client.ip", "ignore_missing": true, "target_field": "client.geo" } }, { "geoip": { "database_file": "GeoIP2-ISP.mmdb", "field": "client.ip", "ignore_missing": true, "target_field": "client.as" } } } ``` Results in: ```auto { "error" : { "root_cause" : [ { "type" : "parse_exception", "reason" : "[database_file] Unsupported database type [GeoIP2-ISP]", "property_name" : "database_file", "processor_type" : "geoip", ... ``` The docs mention being able to use multiple database files for this information. The old `GeoIP-ASN` was replaced with `GeoIP2-ISP`, so this should be supported. Is there a way to get past this. I've found 2 other discussions asking this question on this forum with no answer. Maybe, the third time is a charm and someone familiar with the product has the magic incantation. ---
**Author:** ![reyjrar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/reyjrar/32/97040_2.png) [@reyjrar](https://discuss.elastic.co/u/reyjrar)\ **Post date:** [November 15, 2021, 11:03pm UTC](https://discuss.elastic.co/t/cannot-load-maxmind-geoip2-isp-mmdb/289027/2 "2021-11-15T23:03:08Z")
Crickets? Anyone from Elastic able to comment? Would love to get ASN processing working with ingest-geoip. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 15, 2021, 11:20pm UTC](https://discuss.elastic.co/t/cannot-load-maxmind-geoip2-isp-mmdb/289027/3 "2021-11-15T23:20:30Z")
> [@reyjrar](#): > > The old `GeoIP-ASN` was replaced with `GeoIP2-ISP` , so this should be supported. Curious... I looked a bit where does it say in the elastic docs that GeoIP2-ISP is supported (not saying we don't I just don't see it in our docs). From the MaxMind site the format of the ISP database is different than the ASN database. And the docs appear to say > You can also use custom city, country, and ASN `.mmdb` files. These files must be uncompressed and use the respective `-City.mmdb` , `-Country.mmdb` , or `-ASN.mmdb` extensions. I am trying to check, but I am thinking that is not supported at the moment, because it is not actually a GEOIP lookup, i.e. it does not contain a lat / lon which is expected (i.e. the GEO portion of the equation) it just has ISP / ASN info so perhaps it is more of a standard enrich lookup. If I get a chance I will look. Update.. interesting yes ASN contains no geo data... I will look more, it could be it is simply a different format / set of columns. Update 2 : Looks like a flat out feature request, not currently supported. Looks like it is supported with Logastash [Here](https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html) > The path to MaxMind’s database file that Logstash should use. The default database is GeoLite2-City. GeoLite2-City, GeoLite2-Country, GeoLite2-ASN are the free databases from MaxMind that are supported. **GeoIP2-City, GeoIP2-ISP, GeoIP2-Country** are the commercial databases from MaxMind that are supported. ---
**Author:** ![reyjrar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/reyjrar/32/97040_2.png) [@reyjrar](https://discuss.elastic.co/u/reyjrar)\ **Post date:** [November 16, 2021, 1:51am UTC](https://discuss.elastic.co/t/cannot-load-maxmind-geoip2-isp-mmdb/289027/4 "2021-11-16T01:51:14Z")
[https://www.elastic.co/guide/en/elasticsearch/reference/7.16/geoip-processor.html#using-ingest-geoip](https://www.elastic.co/guide/en/elasticsearch/reference/7.16/geoip-processor.html#using-ingest-geoip) The "GeoLite2-ASN.mmdb" is listed, but there is no paid -ASN.mmdb, the -ISP.mmdb is the paid version with this data. See: [https://www.maxmind.com/en/geoip2-databases](https://www.maxmind.com/en/geoip2-databases) Notice there's no ASN DB. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 16, 2021, 2:06am UTC](https://discuss.elastic.co/t/cannot-load-maxmind-geoip2-isp-mmdb/289027/5 "2021-11-16T02:06:16Z")
I purchased a `GeoIP2-ISP.mmdb` and tried, it is not currently supported (AFAICT) I also tried to build a direct enrich processor from the ISP CSV but that did not work because of the IP range search is not supported (that would have been a good workaround) You _ **can** _ use Logstash see [here](https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html) I opened a feature Request Here. Please add to it as you see fit > > > Please Support the MaxMind \`GeoIP2-ISP.mmdb\` Commercially Licensed Database it i…s part of the commercially available MaxMind Databases. > > As a User I would like to enrich incoming IPs with ISP information. > > Today Logstash does support enriching with this ISP database however Elasticsearch Enrich processor does not. > > > \`\`\` > PUT \_ingest/pipeline/isp-lookup > { > "description": "Adds geoip info for ECS documents", > "processors": \[ > { > "geoip": { > "database\_file": "GeoIP2-ISP.mmdb", > "field": "client.ip", > "ignore\_missing": true, > "target\_field": "client.as" > } > } > \] > } > \`\`\` > > \`\`\` > { > "error" : { > "root\_cause" : \[ > { > "type" : "parse\_exception", > "reason" : "\[database\_file\] Unsupported database type \[GeoIP2-ISP\]", > "property\_name" : "database\_file", > "processor\_type" : "geoip" > } > \], > "type" : "parse\_exception", > "reason" : "\[database\_file\] Unsupported database type \[GeoIP2-ISP\]", > "property\_name" : "database\_file", > "processor\_type" : "geoip" > }, > "status" : 400 > } > > \`\`\` ---
**Author:** ![reyjrar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/reyjrar/32/97040_2.png) [@reyjrar](https://discuss.elastic.co/u/reyjrar)\ **Post date:** [November 16, 2021, 9:42pm UTC](https://discuss.elastic.co/t/cannot-load-maxmind-geoip2-isp-mmdb/289027/6 "2021-11-16T21:42:28Z")
Awesome! Thanks! ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 16, 2021, 10:45pm UTC](https://discuss.elastic.co/t/cannot-load-maxmind-geoip2-isp-mmdb/289027/7 "2021-11-16T22:45:25Z")
You should add your comments to the feature request, actual users / customer can help otherwise it is just me. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 14, 2021, 10:45pm UTC](https://discuss.elastic.co/t/cannot-load-maxmind-geoip2-isp-mmdb/289027/8 "2021-12-14T22:45:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.