Hello
I tried to use this DB for enrichment but it throws
"Unsupported database type GeoIP2-Connection-Type" error
Is there any chance this will be supported in the future?
logstash config
geoip {
database => "/etc/logstash/translate/GeoIP2-Connection-Type.mmdb"
source => "[destination][ip]"
target => "[destination][connection_type]"
}
Debug logs
[2021-03-03T11:55:00,566][DEBUG][logstash.inputs.file ][main][48663f833dd99d7caad36b843fc43cc9de915f3474d25a8c5c4a0e68c26d60c5] Received line {:path=>"/tmp/data.json", :text=>"{\"source\": {\"ip\": \"1.1.1.1\",\"port\": \"5555\"}}"}
[2021-03-03T11:55:00,751][ERROR][logstash.javapipeline ][main] Pipeline worker error, the pipeline will be stopped {:pipeline_id=>"main", :error=>"Unsupported database type GeoIP2-Connection-Type", :exception=>Java::JavaLang::IllegalStateException, :backtrace=>["org.logstash.filters.GeoIPFilter.handleEvent(org/logstash/filters/GeoIPFilter.java:177)", "jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)", "jdk.internal.reflect.NativeMethodAccessorImpl.invoke(jdk/internal/reflect/NativeMethodAccessorImpl.java:62)", "jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(jdk/internal/reflect/DelegatingMethodAccessorImpl.java:43)", "java.lang.reflect.Method.invoke(java/lang/reflect/Method.java:566)", "org.jruby.javasupport.JavaMethod.invokeDirectWithExceptionHandling(org/jruby/javasupport/JavaMethod.java:426)", "org.jruby.javasupport.JavaMethod.invokeDirect(org/jruby/javasupport/JavaMethod.java:293)", "usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_filter_minus_geoip_minus_7_dot_0_dot_0_minus_java.lib.logstash.filters.geoip.filter(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.0.0-java/lib/logstash/filters/geoip.rb:99)", "usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_filter_minus_geoip_minus_7_dot_0_dot_0_minus_java.lib.logstash.filters.geoip.RUBY$method$filter$0$__VARARGS__(usr/share/logstash/vendor/bundle/jruby/$2_dot_5_dot_0/gems/logstash_minus_filter_minus_geoip_minus_7_dot_0_dot_0_minus_java/lib/logstash/filters//usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.0.0-java/lib/logstash/filters/geoip.rb)", "usr.share.logstash.logstash_minus_core.lib.logstash.filters.base.do_filter(/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:159)", "usr.share.logstash.logstash_minus_core.lib.logstash.filters.base.RUBY$method$do_filter$0$__VARARGS__(usr/share/logstash/logstash_minus_core/lib/logstash/filters//usr/share/logstash/logstash-core/lib/logstash/filters/base.rb)", "usr.share.logstash.logstash_minus_core.lib.logstash.filters.base.multi_filter(/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:178)", "org.jruby.RubyArray.each(org/jruby/RubyArray.java:1809)", "usr.share.logstash.logstash_minus_core.lib.logstash.filters.base.multi_filter(/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:175)", "org.logstash.config.ir.compiler.FilterDelegatorExt.doMultiFilter(org/logstash/config/ir/compiler/FilterDelegatorExt.java:127)", "org.logstash.config.ir.compiler.AbstractFilterDelegatorExt.multi_filter(org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:134)", "org.logstash.generated.CompiledDataset1.compute(org/logstash/generated/CompiledDataset1)", "org.logstash.config.ir.CompiledPipeline$CompiledUnorderedExecution.compute(org/logstash/config/ir/CompiledPipeline.java:329)", "org.logstash.config.ir.CompiledPipeline$CompiledUnorderedExecution.compute(org/logstash/config/ir/CompiledPipeline.java:323)", "org.logstash.execution.WorkerLoop.run(org/logstash/execution/WorkerLoop.java:83)", "jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)", "jdk.internal.reflect.NativeMethodAccessorImpl.invoke(jdk/internal/reflect/NativeMethodAccessorImpl.java:62)", "jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(jdk/internal/reflect/DelegatingMethodAccessorImpl.java:43)", "java.lang.reflect.Method.invoke(java/lang/reflect/Method.java:566)", "org.jruby.javasupport.JavaMethod.invokeDirectWithExceptionHandling(org/jruby/javasupport/JavaMethod.java:441)", "org.jruby.javasupport.JavaMethod.invokeDirect(org/jruby/javasupport/JavaMethod.java:305)", "usr.share.logstash.logstash_minus_core.lib.logstash.java_pipeline.start_workers(/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:295)", "org.jruby.RubyProc.call(org/jruby/RubyProc.java:318)", "java.lang.Thread.run(java/lang/Thread.java:834)"], :thread=>"#<Thread:0x32caaebf sleep>"}
[2021-03-03T11:55:00,764][DEBUG][logstash.javapipeline ][main] Closing inputs {:pipeline_id=>"main", :thread=>"#<Thread:0x32caaebf run>"}
[2021-03-03T11:55:00,766][DEBUG][logstash.inputs.file ][main] Stopping {:plugin=>"LogStash::Inputs::File"}
[2021-03-03T11:55:00,786][INFO ][filewatch.observingtail ][main] QUIT - closing all files and shutting down.
As workaround I have this
ruby {
init =>
"
require 'maxmind/db'
READER = MaxMind::DB.new('/etc/logstash/translate/GeoIP2-Connection-Type.mmdb', mode: MaxMind::DB::MODE_MEMORY)
"
code =>
"
tmpSRCIP = event.get('[source][ip]')
record = READER.get(tmpSRCIP)
if record.nil?
#do nothing
else
event.set('[destination][connection_type]', record['connection_type'])
end
"
}
Requirements
/usr/share/logstash/bin/ruby -S gem install maxmind-db
add "gem "maxmind-db" to /usr/share/logstash/Gemfile
/usr/share/logstash/bin/logstash-plugin update