_geoip_database_unavailable_GeoLite2-ASN.mmdb

Elastic Stack Beats
22

Sorry but that is not the correct part of the logs... there are many many logs perhaps take the file

grep -i geo my-application.log

and show those results...

I am asking internally... I am seeing some inconsistency in 8.7.0... but oddly not with your version the geo dbs loaded right away...

BTW this is what geostats should look like... seeing if there is a command to force reload..

curl 'localhost:9200/_ingest/geoip/stats?pretty'
{
  "stats" : {
    "successful_downloads" : 3,
    "failed_downloads" : 0,
    "total_download_time" : 5082,
    "databases_count" : 3,
    "skipped_updates" : 0,
    "expired_databases" : 0
  },
  "nodes" : {
    "3-C7p0V6TZegryYhcK7ayA" : {
      "databases" : [
        {
          "name" : "GeoLite2-City.mmdb"
        },
        {
          "name" : "GeoLite2-Country.mmdb"
        },
        {
          "name" : "GeoLite2-ASN.mmdb"
        }
      ],
      "files_in_temp" : [
        "GeoLite2-ASN.mmdb_elastic-geoip-database-service-agreement-LICENSE.txt",
        "GeoLite2-ASN.mmdb_LICENSE.txt",
        "GeoLite2-City.mmdb_LICENSE.txt",
        "GeoLite2-Country.mmdb_elastic-geoip-database-service-agreement-LICENSE.txt",
        "GeoLite2-ASN.mmdb",
        "GeoLite2-City.mmdb_COPYRIGHT.txt",
        "GeoLite2-City.mmdb",
        "GeoLite2-City.mmdb_elastic-geoip-database-service-agreement-LICENSE.txt",
        "GeoLite2-Country.mmdb_LICENSE.txt",
        "GeoLite2-Country.mmdb",
        "GeoLite2-ASN.mmdb_COPYRIGHT.txt",
        "GeoLite2-Country.mmdb_COPYRIGHT.txt",
        "GeoLite2-City.mmdb_README.txt"
      ]
    }
  }
}

I have one other thing you can try...

Try to disable then reenable

Disable the geoip databases

PUT _cluster/settings
{
  "persistent": {
    "ingest.geoip.downloader.enabled" : false
  }
}

GET _cat/indices/.ge*?v

GET _ingest/geoip/stats

Wait about 2 mins then re-enable

PUT _cluster/settings
{
  "persistent": {
    "ingest.geoip.downloader.enabled" : true
  }
}

GET _cat/indices/.ge*?v

GET _ingest/geoip/stats

Let me know if that works

You also try setting false / true in elasticsearch.yml and start stop see if that works

23

here is the log as you suggested after inputting grep -i geo my-application.log :

org.elasticsearch.ElasticsearchException: not all primary shards of [.geoip_databases] index are active
        at org.elasticsearch.ingest.geoip.GeoIpDownloader.updateDatabases(GeoIpDownloader.java:134) ~[?:?]
        at org.elasticsearch.ingest.geoip.GeoIpDownloader.runDownloader(GeoIpDownloader.java:274) ~[?:?]
        at org.elasticsearch.ingest.geoip.GeoIpDownloaderTaskExecutor.nodeOperation(GeoIpDownloaderTaskExecutor.java:102) ~[?:?]
        at org.elasticsearch.ingest.geoip.GeoIpDownloaderTaskExecutor.nodeOperation(GeoIpDownloaderTaskExecutor.java:48) ~[?:?]
[2023-04-26T02:01:39,499][WARN ][o.e.i.g.GeoIpDownloader  ] [node-1] could not delete old chunks for geoip database [GeoLite2-Country.mmdb]
        at org.elasticsearch.ingest.geoip.GeoIpDownloader.deleteOldChunks(GeoIpDownloader.java:200) ~[?:?]
        at org.elasticsearch.ingest.geoip.GeoIpDownloader.lambda$cleanDatabases$4(GeoIpDownloader.java:295) ~[?:?]
        at org.elasticsearch.ingest.geoip.GeoIpDownloader.cleanDatabases(GeoIpDownloader.java:302) ~[?:?]
        at org.elasticsearch.ingest.geoip.GeoIpDownloader.runDownloader(GeoIpDownloader.java:280) ~[?:?]
        at org.elasticsearch.ingest.geoip.GeoIpDownloaderTaskExecutor.nodeOperation(GeoIpDownloaderTaskExecutor.java:102) ~[?:?]
        at org.elasticsearch.ingest.geoip.GeoIpDownloaderTaskExecutor.nodeOperation(GeoIpDownloaderTaskExecutor.java:48) ~[?:?]
Caused by: org.elasticsearch.action.search.SearchPhaseExecutionException: Search rejected due to missing shards [[.geoip_databases][0]]. Consider using `allow_partial_search_results` setting to bypass this error.
[2023-04-26T02:01:40,508][WARN ][o.e.i.g.GeoIpDownloader  ] [node-1] could not delete old chunks for geoip database [GeoLite2-City.mmdb]
        at org.elasticsearch.ingest.geoip.GeoIpDownloader.deleteOldChunks(GeoIpDownloader.java:200) ~[?:?]
        at org.elasticsearch.ingest.geoip.GeoIpDownloader.lambda$cleanDatabases$4(GeoIpDownloader.java:295) ~[?:?]
        at org.elasticsearch.ingest.geoip.GeoIpDownloader.cleanDatabases(GeoIpDownloader.java:302) ~[?:?]
        at org.elasticsearch.ingest.geoip.GeoIpDownloader.runDownloader(GeoIpDownloader.java:280) ~[?:?]
        at org.elasticsearch.ingest.geoip.GeoIpDownloaderTaskExecutor.nodeOperation(GeoIpDownloaderTaskExecutor.java:102) ~[?:?]
        at org.elasticsearch.ingest.geoip.GeoIpDownloaderTaskExecutor.nodeOperation(GeoIpDownloaderTaskExecutor.java:48) ~[?:?]
Caused by: org.elasticsearch.action.search.SearchPhaseExecutionException: Search rejected due to missing shards [[.geoip_databases][0]]. Consider using `allow_partial_search_results` setting to bypass this error.

this is the same output as before when i run curl 'localhost:9200/_ingest/geoip/stats?pretty'

{
  "stats" : {
    "successful_downloads" : 0,
    "failed_downloads" : 1,
    "total_download_time" : 0,
    "databases_count" : 0,
    "skipped_updates" : 0,
    "expired_databases" : 3
  },
  "nodes" : { }
}
24

Thank you so much @stephenb !!!, , it is working now!, I disabled and reanabled the geoip.downloader as you outlined above and it worked. Miraculous :smile:

1 Like
25

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.