# Elasticsearch GeoIP and unknown error **URL:** \ **Category:** Elasticsearch\ **Created:** [October 13, 2022, 1:30pm UTC](https://discuss.elastic.co/t/elasticsearch-geoip-and-unknown-error/316541 "2022-10-13T13:30:42Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![ulysse31](https://avatars.discourse-cdn.com/v4/letter/u/7ba0ec/32.png) [@ulysse31](https://discuss.elastic.co/u/ulysse31)\ **Post date:** [October 13, 2022, 1:30pm UTC](https://discuss.elastic.co/t/elasticsearch-geoip-and-unknown-error/316541/1 "2022-10-13T13:30:42Z")
Hi, My elasticsearch DB suddently stopped making geoip resolve on entries, and on the elasticsearch DB logs the following message is logged: [2022-10-13T15:06:21,875][WARN][o.e.i.g.GeoIpDownloader] [host] could not delete old chunks for geoip database [GeoLite2-City.mmdb] This message is in loop ... don't know why it came ... I tried googling the error message, no answers ^^' Does someone as some idea about this ? UPDATE: Found another interresting log line saying: Search rejected due to missing shards [[.geoip\_databases][0]]. Consider using `allow_partial_search_results` setting to bypass this error. Thanks a lot ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [October 13, 2022, 5:46pm UTC](https://discuss.elastic.co/t/elasticsearch-geoip-and-unknown-error/316541/2 "2022-10-13T17:46:45Z")
Hi @ulysse31 What version are you running? One thing you _could_ try is set this in your elasticsearch.yml and restart elasticsearch (you would need to do it on all the data nodes\_ `ingest.geoip.downloader.enabled: false` This should try to clean up all thing geoip... (should get rid of the databases and actually clean up the geoip enrich indices Thne set back to `true` or take out and restart `ingest.geoip.downloader.enabled: true` That should re-initialize things See if that helps... could be something else though... ---
**Author:** ![rachel\_gomez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rachel_gomez/32/108615_2.png) [@rachel\_gomez](https://discuss.elastic.co/u/rachel_gomez)\ **Post date:** [October 14, 2022, 6:03am UTC](https://discuss.elastic.co/t/elasticsearch-geoip-and-unknown-error/316541/3 "2022-10-14T06:03:48Z")
If you're getting the "Could Not Resolve Host Elasticsearch Unknown Error" when trying to connect to Elasticsearch, it's likely because your Elasticsearch instance is not accessible from the network. To fix this, you'll need to add the following line to your Elasticsearch.yml file: network.host: 0.0.0.0 This will bind Elasticsearch to all network interfaces, which will make it accessible from anywhere. Regards, Rachel Gomez ---
**Author:** ![ulysse31](https://avatars.discourse-cdn.com/v4/letter/u/7ba0ec/32.png) [@ulysse31](https://discuss.elastic.co/u/ulysse31)\ **Post date:** [October 14, 2022, 7:17am UTC](https://discuss.elastic.co/t/elasticsearch-geoip-and-unknown-error/316541/4 "2022-10-14T07:17:38Z")
Hi all, Disabling and re-enabling again did seem to correct the issue ^^' : [2022-10-14T09:06:31,512][INFO][o.e.i.g.DatabaseNodeService] [host] retrieve geoip database [GeoLite2-ASN.mmdb] from [.geoip\_databases] to [/tmp/elasticsearch-10198363484070202212/geoip-databases/s3-uO9IpT1ithOFzkPyVpg/GeoLite2-ASN.mmdb.tmp.gz] [2022-10-14T09:06:31,523][INFO][o.e.i.g.GeoIpDownloader] [host] successfully downloaded geoip database [GeoLite2-ASN.mmdb] [2022-10-14T09:06:31,606][INFO][o.e.i.g.DatabaseNodeService] [host] successfully reloaded changed geoip database file [/tmp/elasticsearch-10198363484070202212/geoip-databases/s3-uO9IpT1ithOFzkPyVpg/GeoLite2-ASN.mmdb] [2022-10-14T09:06:33,615][INFO][o.e.i.g.DatabaseNodeService] [host] retrieve geoip database [GeoLite2-City.mmdb] from [.geoip\_databases] to [/tmp/elasticsearch-10198363484070202212/geoip-databases/s3-uO9IpT1ithOFzkPyVpg/GeoLite2-City.mmdb.tmp.gz] [2022-10-14T09:06:33,624][INFO][o.e.i.g.GeoIpDownloader] [host] successfully downloaded geoip database [GeoLite2-City.mmdb] [2022-10-14T09:06:34,174][INFO][o.e.i.g.DatabaseNodeService] [host] retrieve geoip database [GeoLite2-Country.mmdb] from [.geoip\_databases] to [/tmp/elasticsearch-10198363484070202212/geoip-databases/s3-uO9IpT1ithOFzkPyVpg/GeoLite2-Country.mmdb.tmp.gz] [2022-10-14T09:06:34,181][INFO][o.e.i.g.GeoIpDownloader] [host] successfully downloaded geoip database [GeoLite2-Country.mmdb] [2022-10-14T09:06:34,236][INFO][o.e.i.g.DatabaseNodeService] [host] successfully reloaded changed geoip database file [/tmp/elasticsearch-10198363484070202212/geoip-databases/s3-uO9IpT1ithOFzkPyVpg/GeoLite2-Country.mmdb] [2022-10-14T09:06:34,265][INFO][o.e.i.g.DatabaseNodeService] [host] successfully reloaded changed geoip database file [/tmp/elasticsearch-10198363484070202212/geoip-databases/s3-uO9IpT1ithOFzkPyVpg/GeoLite2-City.mmdb] Even if I do not know exactly what caused it 😕 ... Really hope it won't happen again ... What about the entries that could not resolve and got tagged "\_geoip\_expired\_database" ? will they be automatically corrected ? (I spotted the error in the log because of spotting events being tagged with it initially ^^' ) Thanks a lot again for the help. Regards, ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [October 14, 2022, 7:48am UTC](https://discuss.elastic.co/t/elasticsearch-geoip-and-unknown-error/316541/5 "2022-10-14T07:48:03Z")
I'm not sure what expired messages you're talking about, but when you disable and re-enable first it loads the default that came with your distribution which is typically out of date and then it will load the latest geoip database. Elasticsearch will then keep the database up-to-date. I believe it's a 30 day cycle. . ---
**Author:** ![ulysse31](https://avatars.discourse-cdn.com/v4/letter/u/7ba0ec/32.png) [@ulysse31](https://discuss.elastic.co/u/ulysse31)\ **Post date:** [October 14, 2022, 8:01am UTC](https://discuss.elastic.co/t/elasticsearch-geoip-and-unknown-error/316541/6 "2022-10-14T08:01:22Z")
Sorry I might not have been clear enough, let me reformulate and give more informations: Our elasticsearch DB was updating entries on-the-fly received by filebeat, to insert in the documents geoip informations about the related IPs inside the documents (source/destination IPs). Since the October 12, I started to see documents with tag "\_geoip\_expired\_database", and without geoip informations on it. After looking into elasticsearch logs, I spotted the log : [2022-10-13T15:06:21,875][WARN][o.e.i.g.GeoIpDownloader] [host] could not delete old chunks for geoip database [GeoLite2-City.mmdb] After which I created this discussion. But, if I give a little overlook to documents inside filebeat indexes created between the 12 and the 13, present documents are still with tag "\_geoip\_expired\_database" and without geoip informations. I was asking myself, since I just re-enabled GeoIpDownloader, and it seems to work again as it should (log indicating correct download, and new documents getting geoip informations), If inside the geoip feature on the elasticsearch DB, there is a automatic job that would automatically correct the documents with tag "\_geoip\_expired\_database" and set the geoip informations on those documents ? Thanks a lot ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [October 14, 2022, 4:15pm UTC](https://discuss.elastic.co/t/elasticsearch-geoip-and-unknown-error/316541/7 "2022-10-14T16:15:50Z")
Thanks for the explanation... make sense > [@ulysse31](#): > > If inside the geoip feature on the elasticsearch DB, there is a automatic job that would automatically correct the documents with tag "\_geoip\_expired\_database" and set the geoip informations on those documents ? Unfortunately no .. you would need to re-ingest or perhaps some form of [update by query](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-update-by-query.html) with the ingestion pipeline / geoip processor ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 11, 2022, 4:16pm UTC](https://discuss.elastic.co/t/elasticsearch-geoip-and-unknown-error/316541/8 "2022-11-11T16:16:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.