Default geoip bundled in logstash

Hi, I installed logstash v2.3.4 on Ubuntu 14.04 via apt-get

According to the documentation:

Logstash releases ship with the GeoLiteCity database made available from Maxmind

I do see a GeoLiteCity-2013-01-18.dat file under the vendor/bundle/jruby... folder however when I apply a geoip filter to my route, I don't get any geoip information in my resulting documents.

I had to actually download the GeoLiteCity.dat file from Maxmind, and then configure it in my geoip filter using the database key.

Is this a problem with the packaged GeoLiteCity database being too old and not having information on my IP? Or is this a problem with the geoip filter not finding it's pre-installed database? If the latter, why wouldn't a current build of logstash use a more current version of the GeoLiteCity database?


It'd complain if it wasn't able to open it.

Can't comment to that, but please do raise an issue against the plugin on GH :slight_smile: