GeoIP Procesor

Elastic Stack Elasticsearch
1

Hi All,
I dont have direct internet on my elk cluster , But I want to use geoip processor through ingest pipeline using elastic agent . But in logs it is showing there is no database available. I have downloaded the maxmind database and transfer in data ingest node of cluster in path :/usr/share/elasticsearch/ingest-geoip/
. How can I resolve it either using proxy or offline ?

2

Hello @Priyanka_chauhan

I believe to use offline DB

PUT /_cluster/settings
{
  "persistent": {
    "ingest.geoip.downloader.enabled": false
  }
}

I see your .mmdb file is already in the correct location

PUT _ingest/pipeline/geoip-info
{
  "description": "Add geoip info",
  "processors": [
    {
      "geoip": {
        "field": "client.ip",
        "target_field": "client.geo",
        "database_file": "GeoLite2-City.mmdb",
        "ignore_missing": true
      }
    }
  ]
}

Thanks!!

3

@Priyanka_chauhan be reminded that the maxmind databases are dynamic, you likely want to refresh them according to your chosen schedule appropriate for your use case.

@Tortoise or others maybe know if you need do anything each time a database_file change (due to external factor) happens, or if elasticsearch will just notice automatically.