Geoip filter plugin dat extension and update

Elastic Stack Logstash
1

Hi,

I didn't have any recent (within a year) discussions on the above (most of them are unanswered). My questions are:

  • Can I use the ".dat" extension instead of the ".mmdb" format?
  • Is there any way to avoid restarting the Logstash process after updating the database file?

Thank you!
YvorL

2

No. The database is handled by the MaxMind library and they have declined to add automatic reload after a database update.

1 Like
3

Thank you! Any ideas for the ".dat" extension?

4

Again, for logstash this is just a pass-through to MaxMind. If their library can handle .dat then it will work, if not, it will not. It is not a logstash question, it is a MaxMind question.

5

The plugin is a Logstash plugin installed with the application having official documentation. Users don't really care how it's solved under the hood. It's fine if you don't know the answer for the question, as I mentioned before, those who asked this before, didn't got any answer either.
Also, the ".dat" format is the legacy GeoLite format so one would think it's supported. However, it looks like LS stopped supporting it and needs "mmdb" while -for example- Nginx supports that one.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.