Geoip log file

Elastic Stack Elasticsearch
1

I would like to see if the geoip database is being downloaded. Getting information from Bard, it tells me that I need to create a file on my server here:

/var/log/geoip/geoip.log

I have done this but the geoip.log file is empty. First question, is this correct? Second question how can I trigger Elasticsearch to download the geoip database so that I can see if the log file gets updated.

2

Hello, can you provide a little more context of you want to do?

Not sure what this mean, but this seems to be completely made up by the A.I. tool.

You could check Elasticsearch logs or use the _ingest API as explained in the documentation.

Running the following request in Dev Tools may help.

GET _ingest/geoip/stats
1 Like
3

Thank you for the information, leandrojmp. I ran the following command in SSH and it looks like there have been 0 downloads.

pic001

I'm running Elasticsearch 8.8.2. Is it normal that the geoip is being downloaded as default?

4

I wonder if the reason I'm not seeing any successful downloads is due to me not allowing outside access to post 9200. Are the geoip database updates done through post 9200?

5

No, the geoip databases are downloaded from geoip.elastic.co using port 443.

Do you have any ingest pipeline using the geoip processor? It will only download the database if you have at least one ingest pipeline using the geoip processor.

The documentation has more information on what will be downloaded and from where.

6

Also starting lately the geo DBs are "lazy Loaded"

Blockquote

So you need to actually run the geoip processor once to trigger the download/ install...

That is a new "Feature" that kept me up late one night!
:slight_smile:

7

I do not. So that explains why I'm not seeing any successful downloads of the geoip database.

Thank you.

8

Thank you, stephanb, that is also very useful information.

9

Just run the sample

PUT _ingest/pipeline/geoip
{
  "description" : "Add geoip info",
  "processors" : [
    {
      "geoip" : {
        "field" : "ip"
      }
    }
  ]
}
PUT my-index-000001/_doc/my_id?pipeline=geoip
{
  "ip": "89.160.20.128"
}
GET my-index-000001/_doc/my_id

The check the stats again

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.