Default geoip bundled in logstash

[ctataryn (Craig Tataryn)]

Hi, I installed logstash v2.3.4 on Ubuntu 14.04 via apt-get

According to the documentation:

Logstash releases ship with the GeoLiteCity database made available from Maxmind

I do see a GeoLiteCity-2013-01-18.dat file under the vendor/bundle/jruby... folder however when I apply a geoip filter to my route, I don't get any geoip information in my resulting documents.

I had to actually download the GeoLiteCity.dat file from Maxmind, and then configure it in my geoip filter using the database key.

Is this a problem with the packaged GeoLiteCity database being too old and not having information on my IP? Or is this a problem with the geoip filter not finding it's pre-installed database? If the latter, why wouldn't a current build of logstash use a more current version of the GeoLiteCity database?

[warkolm (Mark Walkom)]

@ctataryn

Is this a problem with the packaged GeoLiteCity database being too old and not having information on my IP?

Possibly.

@ctataryn

Or is this a problem with the geoip filter not finding it's pre-installed database?

It'd complain if it wasn't able to open it.

@ctataryn

If the latter, why wouldn't a current build of logstash use a more current version of the GeoLiteCity database?

Can't comment to that, but please do raise an issue against the plugin on GH