GeoIP processor / setup?

Elastic Stack Kibana
6

I am confused myself :slight_smile:

My concern is missing geoip data for example for the System integration SSH login attemps dashboard. Logs have an source.ip field, but the source.geo.country_iso_code is empty.

The documents also have tags _geoip_database_unavailable_GeoLite2-City.mmdb, _geoip_database_unavailable_GeoLite2-ASN.mmdb set.

curl -k -X GET "https://localhost:9200/_ingest/geoip/stats?pretty"
{
  "stats" : {
    "successful_downloads" : 0,
    "failed_downloads" : 0,
    "total_download_time" : 0,
    "databases_count" : 0,
    "skipped_updates" : 0,
    "expired_databases" : 0
  },
  "nodes" : { }
}

I will try to "turn it off and on again" and report back…