GeoIP DB update issue

Elastic Search
1

Hi,
I have an issue of geoip DB not automatically updating.
i use ubuntu 22 and i had set up a proxy.
Proxy details are set up in /etc/environment.
in elasticsearch.yml i had added poll.interval="1d", so that an update check is done each day.
the error that i get is as following:

024-10-14T05:41:32,431][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [ingest-geoip]
[2024-10-14T05:41:43,999][INFO ][o.e.i.g.ConfigDatabases  ] [node-1] initialized default databases [[GeoLite2-Country.mmdb, GeoLite2-City.mmdb, GeoLite2-ASN.mmdb]], config databases [[]] and watching [/etc/elasticsearch/ingest-geoip] for changes
[2024-10-14T05:41:44,002][INFO ][o.e.i.g.DatabaseNodeService] [node-1] initialized database registry, using geoip-databases directory [/tmp/elasticsearch-12044066651378251017/geoip-databases/4l73s6TISo-rpr_RNhFFjQ]
[2024-10-14T05:41:55,262][INFO ][o.e.i.g.GeoIpDownloader  ] [node-1] updating geoip databases
[2024-10-14T05:41:55,262][INFO ][o.e.i.g.GeoIpDownloader  ] [node-1] fetching geoip databases overview from [
https://geoip.elastic.co/v1/database?elastic_geoip_service_tos=agree]
[2024-10-14T05:42:05,341][ERROR][o.e.i.g.GeoIpDownloader  ] [node-1] exception during geoip databases update
        at org.elasticsearch.ingest.geoip.HttpClient.lambda$get$0(HttpClient.java:55) ~[ingest-geoip-7.17.6.jar:7.17.6]
        at org.elasticsearch.ingest.geoip.HttpClient.doPrivileged(HttpClient.java:97) ~[ingest-geoip-7.17.6.jar:7.17.6]
        at org.elasticsearch.ingest.geoip.HttpClient.get(HttpClient.java:49) ~[ingest-geoip-7.17.6.jar:7.17.6]
        at org.elasticsearch.ingest.geoip.HttpClient.getBytes(HttpClient.java:40) ~[ingest-geoip-7.17.6.jar:7.17.6]
        at org.elasticsearch.ingest.geoip.GeoIpDownloader.fetchDatabasesOverview(GeoIpDownloader.java:159) ~[ingest-geoip-7.17.6.jar:7.17.6]
        at org.elasticsearch.ingest.geoip.GeoIpDownloader.updateDatabases(GeoIpDownloader.java:147) ~[ingest-geoip-7.17.6.jar:7.17.6]
        at org.elasticsearch.ingest.geoip.GeoIpDownloader.runDownloader(GeoIpDownloader.java:284) [ingest-geoip-7.17.6.jar:7.17.6]
        at org.elasticsearch.ingest.geoip.GeoIpDownloaderTaskExecutor.nodeOperation(GeoIpDownloaderTaskExecutor.java:100) [ingest-geoip-7.17.6.jar:7.17.6]
        at org.elasticsearch.ingest.geoip.GeoIpDownloaderTaskExecutor.nodeOperation(GeoIpDownloaderTaskExecutor.java:46) [ingest-geoip-7.17.6.jar:7.17.6]
2

Hi @rahulm

Welcome to the community

What version are you on?

You may need to add another proxy as the actual geodb filles are pulled from Google storage

Perhaps look at this thread... There's a lot at debugging steps in

3

i am using elasticsearch 7.17.13.
i tried the following command and its working.

wget -O GeoLite2-City.tgz "
https://storage.googleapis.com/elastic-paisano-production/maxmind/GeoLite2-ASN.tgz?X-Goog-Algorithm=GOOG4-RSA-SHA256&X-Goog-Credential=elastic-paisano-production%40elastic-apps-163815.iam.gserviceaccount.com%2F20241015%2Fhenk%2Fstorage%2Fgoog4_request&X-Goog-Date=20241015T000108Z&X-Goog-Expires=86400&X-Goog-SignedHeaders=host&X-Goog-Signature=9978470fee35e45c974f6dbb6d95cccee37cb0024958fab88f168ccae083813e5763bc6d80eca972ff994de1f3daddb23fbdd859252502cdf18728feae20099c529e1b9940e74ac78780ec4a0459d383f73b31d08efedee7d1549629340dc867624ff79a4a567429c105419b09ddf229a91080ade22e0b4c078534e13296f99f17357208feee4835e83811e7ce055a7a62e8a39a94bf470def95c5d9d15a935fb34b1db75ff3b385d342fbde44f96109b4fc32204e143a896faa221a1330b9554b9bef4c95ccbc48df4c61f96bfad0c9d338abee857f517e0bdd54f5c1756afbda34ad07b89e9fe409396eec8f66c04b9fe7d541827aabf41e6c3a57bf96cd41"

Also this is working

wget -O https://geoip.elastic.co/v1/database?elastic_geoip_service_tos=agree
4

could you provide an update if possible?

5

Looks like you are 7.17.6

Did you run the wget command from the server where the elasticsearch node is running?

Did you make sure you have room in /tmp? And any process can write there?

Did you read to the through the topic I provided?

Did you disable the downloading restart then stop and enable?

ingest.geoip.downloader.enabled: false

restart

ingest.geoip.downloader.enabled: true

You can turn the logging up to debug.

Did you somehow change the permissions on any of the files or directories?

You're going to have to dig in and try things...

I also recommend upgrading to 8.15.2...

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.