Customized geoip not working with logstash-5.0.1 v

Elastic Stack Logstash
1

I have customized geoip with private networks using mmutils and works fine in logstash 2.3.4 v ,but in logstash 5.0.1 it throws an error ..how can i reslove this ? please do help

Error: with 5.0.1.v

[2017-03-15T00:57:04,100][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9601}
[2017-03-15T00:57:07,009][WARN ][logstash.agent ] stopping pipeline {:id=>"main"}
[2017-03-15T00:59:11,295][INFO ][logstash.filters.geoip ] Using geoip database {:path=>"/home/netstorm/work/mmutils/GeoLiteCity.mmdb"}
[2017-03-15T00:59:11,407][ERROR][logstash.filters.geoip ] The GeoLite2 MMDB database provided is invalid or corrupted. {:exception=>com.maxmind.db.InvalidDatabaseException: Could not find a MaxMind DB metadata marker in this file (GeoLiteCity.mmdb). Is this a valid MaxMind DB file?, :field=>"clientip"}
[2017-03-15T00:59:11,408][ERROR][logstash.agent ] Pipeline aborted due to error {:exception=>com.maxmind.db.InvalidDatabaseException: Could not find a MaxMind DB metadata marker in this file (GeoLiteCity.mmdb). Is this a valid MaxMind DB file?, :backtrace=>["com.maxmind.db.Reader.findMetadataStart(com/maxmind/db/Reader.java:278)", "com.maxmind.db.Reader.(com/maxmind/db/Reader.java:129)", "com.maxmind.db.Reader.(com/maxmind/db/Reader.java:116)", "com.maxmind.geoip2.DatabaseReader.(com/maxmind/geoip2/DatabaseReader.java:37)", "com.maxmind.geoip2.DatabaseReader.(com/maxmind/geoip2/DatabaseReader.java:27)", "com.maxmind.geoip2.DatabaseReader$Builder.build(com/maxmind/geoip2/DatabaseReader.java:133)", "java.lang.reflect.Method.invoke(java/lang/reflect/Method.java:498)", "RUBY.register(/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-geoip-4.0.3-java/lib/logstash/filters/geoip.rb:144)", "RUBY.suppress_all_warnings(/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-geoip-4.0.3-java/lib/logstash/filters/geoip.rb:21)", "RUBY.register(/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-geoip-4.0.3-java/lib/logstash/filters/geoip.rb:130)", "RUBY.register(/usr/share/logstash/vendor/jruby/lib/ruby/1.9/forwardable.rb:201)", "RUBY.start_workers(/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:197)", "org.jruby.RubyArray.each(org/jruby/RubyArray.java:1613)", "RUBY.start_workers(/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:197)", "RUBY.run(/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:153)", "RUBY.start_pipeline(/usr/share/logstash/logstash-core/lib/logstash/agent.rb:250)", "java.lang.Thread.run(java/lang/Thread.java:745)"]}

* indent preformatted text by 4 spaces

3

Logstash v5 (and possibly 2.4) uses the new v2 Maxmind database format. Your v1 file, edits and all, will not work there. You will have to edit the v2 database, which like it sounds, is not similar. It will require different tools to edit.

4

can u suggest any tool which helps to edit v2 mmdb?

5

I personally do not know of any. This doesn't mean they do not exist, of course. I just haven't had occasion to look for them or to use them.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.