I am using geoIP logstash filter for getting the geo location details using IPs in logstash.
For manually updating the maxmind geolite2 databse, we have downloaded the database files(GeoLite2-City.mmdb and GeoLite2-ASN.mmdb) from http://dev.maxmind.com/geoip/geoip2/geolite2 and copied in a folder named "ipdatabase" in one of the Elasticsearch node and succesfullty executed the below command
./bin/Elasticsearch-geoip -s /home/oprroot/ipdatabase
Logstash is in different node. So can someone please tell me which ip and port to use in below configuratioin settings.
xpack.geoip.download.endpoint=http://localhost:8080/overview.json setting in logstash.yml.
One more doubt related to this is about below mentione command is sending an error. Please let me know whats wrong here.
curl --insecure -u user:pass https://IP:9200/_nodes/stats/geoip_download_manager?pretty
{
"error" : {
"root_cause" : [
{
"type" : "illegal_argument_exception",
"reason" : "request [/_nodes/stats/geoip_download_manager] contains unrecognized metric: [geoip_download_manager]"
}
],
"type" : "illegal_argument_exception",
"reason" : "request [/_nodes/stats/geoip_download_manager] contains unrecognized metric: [geoip_download_manager]"
},
"status" : 400
}
Thanks in advance.