_geoip_database_unavailable_GeoLite2-City.mmdb Error

Elastic Stack Elastic Agent
1

Dear Members,

can someone please guide i am facing the below issues don't know unable to lookup my field with geo ip details
[2024-05-14T12:21:49,461][ERROR][o.e.i.g.GeoIpDownloader ] [node1] exception during geoip databases update
java.net.UnknownHostException: geoip.elastic.co
at sun.nio.ch.NioSocketImpl.connect(NioSocketImpl.java:567) ~[?:?]
at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:327) ~[?:?]
at java.net.Socket.connect(Socket.java:751) ~[?:?]
at sun.security.ssl.SSLSocketImpl.connect(SSLSocketImpl.java:304) ~[?:?]
at sun.net.NetworkClient.doConnect(NetworkClient.java:178) ~[?:?]
at sun.net.www.http.HttpClient.openServer(HttpClient.java:531) ~[?:?]
at sun.net.www.http.HttpClient.openServer(HttpClient.java:636) ~[?:?]
at sun.net.www.protocol.https.HttpsClient.(HttpsClient.java:264) ~[?:?]
at sun.net.www.protocol.https.HttpsClient.New(HttpsClient.java:377) ~[?:?]
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(AbstractDelegateHttpsURLConnection.java:193) ~[?:?]
at sun.net.www.protocol.http.HttpURLConnection.plainConnect0(HttpURLConnection.java:1237) ~[?:?]
at sun.net.www.protocol.http.HttpURLConnection.plainConnect(HttpURLConnection.java:1123) ~[?:?]
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:179) ~[?:?]
at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1675) ~[?:?]
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1599) ~[?:?]
at java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:531) ~[?:?]
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:307) ~[?:?]
at org.elasticsearch.ingest.geoip.HttpClient.lambda$get$0(HttpClient.java:46) ~[?:?]
at java.security.AccessController.doPrivileged(AccessController.java:571) ~[?:?]
at org.elasticsearch.ingest.geoip.HttpClient.doPrivileged(HttpClient.java:88) ~[?:?]
at org.elasticsearch.ingest.geoip.HttpClient.get(HttpClient.java:40) ~[?:?]
at org.elasticsearch.ingest.geoip.HttpClient.getBytes(HttpClient.java:36) ~[?:?]
at org.elasticsearch.ingest.geoip.GeoIpDownloader.fetchDatabasesOverview(GeoIpDownloader.java:157) ~[?:?]
at org.elasticsearch.ingest.geoip.GeoIpDownloader.updateDatabases(GeoIpDownloader.java:140) ~[?:?]
at org.elasticsearch.ingest.geoip.GeoIpDownloader.runDownloader(GeoIpDownloader.java:279) ~[?:?]
at org.elasticsearch.ingest.geoip.GeoIpDownloaderTaskExecutor.nodeOperation(GeoIpDownloaderTaskExecutor.java:160) ~[?:?]
at org.elasticsearch.ingest.geoip.GeoIpDownloaderTaskExecutor.nodeOperation(GeoIpDownloaderTaskExecutor.java:59) ~[?:?]
at org.elasticsearch.persistent.NodePersistentTasksExecutor$1.doRun(NodePersistentTasksExecutor.java:42) ~[elasticsearch-8.12.2.jar:?]
at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:983) ~[elasticsearch-8.12.2.jar:?]
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:26) ~[elasticsearch-8.12.2.jar:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) ~[?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) ~[?:?]
at java.lang.Thread.run(Thread.java:1583) ~[?:?]

2

Elasticsearch periodically updates the geoip databases used by default by the geoip processor. I am guessing that you are in a locked-down environment where your Elasticsearch nodes cannot access geoip.elastic.co in order to do this. Assuming you want to use the geoip processor, take a look at GeoIP processor | Elasticsearch Guide [8.13] | Elastic for options.

3

Hi @Keith_Massey ,

got the below error while accessing the api's

image
image1549×489 25.3 KB

image
image964×475 31.9 KB

requesting your support though when i curl the command https://geoip.elastic.co/v1/database/?elastic_geoip_service_tos=agree
i was able to get status 200 from the machine and was also able to curl the maxmind url's

Regards

4

Hi @shrikantgulia. I'm not entirely sure what you're asking. As the end of your post implies, Elasticsearch is trying to hit https://geoip.elastic.co/v1/database?elastic_geoip_service_tos=agree to get the list of available databases and their locations. But Elasticsearch is reporting java.net.UnknownHostException: geoip.elastic.co, meaning that Elasticsearch was unable to find an IP address for geoip.elastic.co, maybe because the administrator of the Elasticsearch cluster doesn't have those Elasticsearch nodes set up to use DNS.

5

Hi @Keith_Massey ,

my machines are behind proxy and geoip.elastic.co does not exist while doing curl got below error

root@vmi1399665:~# curl -v geoip.elastic.co

  • Trying 104.154.207.153:80...
  • Connected to geoip.elastic.co (104.154.207.153) port 80 (#0)

GET / HTTP/1.1
Host: geoip.elastic.co
User-Agent: curl/7.81.0
Accept: /

  • Mark bundle as not supporting multiuse
    < HTTP/1.1 308 Permanent Redirect
    < Date: Wed, 15 May 2024 14:29:21 GMT
    < Content-Type: text/html
    < Content-Length: 164
    < Connection: keep-alive
    < Location: https://geoip.elastic.co
    <
308 Permanent Redirect

308 Permanent Redirect

nginx * Connection #0 to host geoip.elastic.co left intact
6

That's it then. You'll just need to choose one of the options from the documentation I linked above.

7

Hi @Keith_Massey ,

even after updating the setting as below

ingest.geoip.downloader.eager.download: true
ingest.geoip.downloader.enabled: true
ingest.geoip.downloader.endpoint: https://geoip.elastic.co/v1/database

i am still facing the issue.

8

It looks like you've configured it to use what is already the default. You need to either set up a way for your nodes to access geoip.elastic.co (a reverse proxy is what is recommended in the documentation), or host the files on a machine inside your network (that's what ingest.geoip.downloader.endpoint would point to). Either way you probably need to work with your network administrator.

9

Dear @Keith_Massey ,

I have one doubt
why are we getting 404 error when i am having open internet while accessing geoip.elastic.co
just curious

image
image1840×615 28.6 KB

10

That's because we don't have anything at the URL https://geoip.elastic.co/. The list of databases is at https://geoip.elastic.co/v1/database?elastic_geoip_service_tos=agree.

11

Dear @Keith_Massey ,

my machine is connected to internet via proxy server still facing the error.
requesting your advice and support

12

Dear @Keith_Massey ,

Resolved it by inserting the proxy details in jvm.options file

Proxy

-Dhttp.proxyHost=
-Dhttp.proxyPort=
-Dhttps.proxyHost=
-Dhttps.proxyPort=

2 Likes