# Geoip2 ASN resolution in Ingest Pipeline

**URL:** <https://discuss.elastic.co/t/geoip2-asn-resolution-in-ingest-pipeline/356093>\
**Category:** Elasticsearch\
**Tags:** ingest-pipeline\
**Created:** [March 25, 2024, 11:42am UTC](https://discuss.elastic.co/t/geoip2-asn-resolution-in-ingest-pipeline/356093 "2024-03-25T11:42:48Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Patryk\_Ostrowski](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patryk_ostrowski/32/111965_2.png) [@Patryk\_Ostrowski](https://discuss.elastic.co/u/Patryk_Ostrowski)\
**Post date:** [March 25, 2024, 11:42am UTC](https://discuss.elastic.co/t/geoip2-asn-resolution-in-ingest-pipeline/356093/1 "2024-03-25T11:42:48Z")

</div>

Hello, I tried to use GeoIP2 plugin to resolve iP to ASN. Unfortunately during log processing I have information in tag:

```auto
	
[netflow, forwarded, _geoip_database_unavailable_GeoLite2-City.mmdb, _geoip_database_unavailable_GeoLite2-City.mmdb, _geoip_database_unavailable_GeoLite2-ASN.mmdb, _geoip_database_unavailable_GeoLite2-ASN.mmdb]

```

I am trying to read data from netflow.destination\_ipv4\_address.

```auto
    {
      "geoip": {
        "field": "netflow.destination_ipv4_address",
        "target_field": "destination.as",
        "database_file": "GeoLite2-ASN.mmdb",
        "properties": [
          "asn",
          "organization_name"
        ],
        "ignore_missing": true
      }
    },

```

Could you help me why database are not avaiable?

I tried to disable plugin:

```auto
PUT _cluster/settings
{
  "persistent": {
    "ingest.geoip.downloader.enabled" : false
  }
}

```

Next I restarted all nodes, changed parametr to true and restarted nodes. But It didn't help me

Error logs:

```auto
[2024-03-25T12:28:53,361][ERROR][o.e.i.g.GeoIpDownloader] [node-1] error downloading geoip database [GeoLite2-ASN.mmdb]
   at org.elasticsearch.ingest.geoip.HttpClient.lambda$get$0(HttpClient.java:46) ~[?:?]
   at org.elasticsearch.ingest.geoip.HttpClient.doPrivileged(HttpClient.java:88) ~[?:?]
   at org.elasticsearch.ingest.geoip.HttpClient.get(HttpClient.java:40) ~[?:?]
   at org.elasticsearch.ingest.geoip.GeoIpDownloader.processDatabase(GeoIpDownloader.java:179) ~[?:?]
   at org.elasticsearch.ingest.geoip.GeoIpDownloader.updateDatabases(GeoIpDownloader.java:143) ~[?:?]
   at org.elasticsearch.ingest.geoip.GeoIpDownloader.runDownloader(GeoIpDownloader.java:279) ~[?:?]
   at org.elasticsearch.ingest.geoip.GeoIpDownloaderTaskExecutor.nodeOperation(GeoIpDownloaderTaskExecutor.java:161) ~[?:?]
   at org.elasticsearch.ingest.geoip.GeoIpDownloaderTaskExecutor.nodeOperation(GeoIpDownloaderTaskExecutor.java:60) ~[?:?]

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 25, 2024, 12:39pm UTC](https://discuss.elastic.co/t/geoip2-asn-resolution-in-ingest-pipeline/356093/2 "2024-03-25T12:39:24Z")

</div>

> [@Patryk\_Ostrowski](#):
>
> ```auto
> PUT _cluster/settings
> {
> "persistent": {
> "ingest.geoip.downloader.enabled" : false
> }
> }
> 
> ```

If you want to use the GeoIP processor you need this to be **enabled**.

> [@Patryk\_Ostrowski](#):
>
> `[2024-03-25T12:28:53,361][ERROR][o.e.i.g.GeoIpDownloader] [node-1] error downloading geoip database [GeoLite2-ASN.mmdb]`

Your nodes have internet access? What is the return of the following request on dev tools?

```auto
GET _ingest/geoip/stats

```

---

<div class="post-metadata">

**Author:** ![Patryk\_Ostrowski](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patryk_ostrowski/32/111965_2.png) [@Patryk\_Ostrowski](https://discuss.elastic.co/u/Patryk_Ostrowski)\
**Post date:** [March 25, 2024, 1:01pm UTC](https://discuss.elastic.co/t/geoip2-asn-resolution-in-ingest-pipeline/356093/3 "2024-03-25T13:01:46Z")

</div>

Thank you for your anserw. I set temporary this option to false, after restart I change again to true and restart.

Unfortunately I have a error:

```auto
Request:
GET _ingest/geoip/stats

Response:
{
  "stats": {
    "successful_downloads": 0,
    "failed_downloads": 3,
    "total_download_time": 0,
    "databases_count": 0,
    "skipped_updates": 0,
    "expired_databases": 0
  },
  "nodes": {}
}

```

I log file I founded:

```auto
[2024-03-25T12:30:55,750][ERROR][o.e.i.g.GeoIpDownloader] [node-1] error downloading geoip database [GeoLite2-ASN.mmdb]
   at org.elasticsearch.ingest.geoip.HttpClient.lambda$get$0(HttpClient.java:46) ~[?:?]
   at org.elasticsearch.ingest.geoip.HttpClient.doPrivileged(HttpClient.java:88) ~[?:?]
   at org.elasticsearch.ingest.geoip.HttpClient.get(HttpClient.java:40) ~[?:?]
   at org.elasticsearch.ingest.geoip.GeoIpDownloader.processDatabase(GeoIpDownloader.java:179) ~[?:?]
   at org.elasticsearch.ingest.geoip.GeoIpDownloader.updateDatabases(GeoIpDownloader.java:143) ~[?:?]
   at org.elasticsearch.ingest.geoip.GeoIpDownloader.runDownloader(GeoIpDownloader.java:279) ~[?:?]
   at org.elasticsearch.ingest.geoip.GeoIpDownloaderTaskExecutor.nodeOperation(GeoIpDownloaderTaskExecutor.java:161) ~[?:?]
   at org.elasticsearch.ingest.geoip.GeoIpDownloaderTaskExecutor.nodeOperation(GeoIpDownloaderTaskExecutor.java:60) ~[?:?]
[2024-03-25T12:30:55,780][ERROR][o.e.i.g.GeoIpDownloader] [node-1] error downloading geoip database [GeoLite2-City.mmdb]
   at org.elasticsearch.ingest.geoip.HttpClient.lambda$get$0(HttpClient.java:46) ~[?:?]
   at org.elasticsearch.ingest.geoip.HttpClient.doPrivileged(HttpClient.java:88) ~[?:?]
   at org.elasticsearch.ingest.geoip.HttpClient.get(HttpClient.java:40) ~[?:?]
   at org.elasticsearch.ingest.geoip.GeoIpDownloader.processDatabase(GeoIpDownloader.java:179) ~[?:?]
   at org.elasticsearch.ingest.geoip.GeoIpDownloader.updateDatabases(GeoIpDownloader.java:143) ~[?:?]
   at org.elasticsearch.ingest.geoip.GeoIpDownloader.runDownloader(GeoIpDownloader.java:279) ~[?:?]
   at org.elasticsearch.ingest.geoip.GeoIpDownloaderTaskExecutor.nodeOperation(GeoIpDownloaderTaskExecutor.java:161) ~[?:?]
   at org.elasticsearch.ingest.geoip.GeoIpDownloaderTaskExecutor.nodeOperation(GeoIpDownloaderTaskExecutor.java:60) ~[?:?]
[2024-03-25T12:30:55,791][ERROR][o.e.i.g.GeoIpDownloader] [node-1] error downloading geoip database [GeoLite2-Country.mmdb]
   at org.elasticsearch.ingest.geoip.HttpClient.lambda$get$0(HttpClient.java:46) ~[?:?]
   at org.elasticsearch.ingest.geoip.HttpClient.doPrivileged(HttpClient.java:88) ~[?:?]
   at org.elasticsearch.ingest.geoip.HttpClient.get(HttpClient.java:40) ~[?:?]
   at org.elasticsearch.ingest.geoip.GeoIpDownloader.processDatabase(GeoIpDownloader.java:179) ~[?:?]
   at org.elasticsearch.ingest.geoip.GeoIpDownloader.updateDatabases(GeoIpDownloader.java:143) ~[?:?]
   at org.elasticsearch.ingest.geoip.GeoIpDownloader.runDownloader(GeoIpDownloader.java:279) ~[?:?]
   at org.elasticsearch.ingest.geoip.GeoIpDownloaderTaskExecutor.nodeOperation(GeoIpDownloaderTaskExecutor.java:161) ~[?:?]
   at org.elasticsearch.ingest.geoip.GeoIpDownloaderTaskExecutor.nodeOperation(GeoIpDownloaderTaskExecutor.java:60) ~[?:?]

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 25, 2024, 1:18pm UTC](https://discuss.elastic.co/t/geoip2-asn-resolution-in-ingest-pipeline/356093/4 "2024-03-25T13:18:17Z")

</div>

> [@leandrojmp](#):
>
> Your nodes have internet access?

Did you validate that? Check if the nodes can access `https://geoip.elastic.co/v1/database`

Use a curl from the node to test.

```auto
https://geoip.elastic.co/v1/database

```

You should get a 400 response, because you are not sending the correct payload, but this would test if the node has internet connection or not to the endpoint.

---

<div class="post-metadata">

**Author:** ![Patryk\_Ostrowski](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patryk_ostrowski/32/111965_2.png) [@Patryk\_Ostrowski](https://discuss.elastic.co/u/Patryk_Ostrowski)\
**Post date:** [March 25, 2024, 1:29pm UTC](https://discuss.elastic.co/t/geoip2-asn-resolution-in-ingest-pipeline/356093/5 "2024-03-25T13:29:04Z")

</div>

> [@leandrojmp](#):
>
> `https://geoip.elastic.co/v1/database`

Yes I tried that:

```auto
root@siem:# curl https://geoip.elastic.co/v1/database
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="utf-8">
    <title>400 Bad Request</title>
</head>
<body align="center">
    <div role="main" align="center">
        <h1>400: Bad Request</h1>
        <p>The request could not be understood by the server due to malformed syntax.</p>
        <hr />
    </div>
    <div role="contentinfo" align="center">
        <small>Rocket</small>
    </div>
</body>

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [March 25, 2024, 2:41pm UTC](https://discuss.elastic.co/t/geoip2-asn-resolution-in-ingest-pipeline/356093/6 "2024-03-25T14:41:48Z")

</div>

Hi @Patryk_Ostrowski

There was another user having issues... see below

What version are you on?

You could set the logs to `TRACE` and see if there's more detail

You can use this

```auto
PUT /_cluster/settings
{
  "persistent": {
    "logger.org.elasticsearch.ingest.geoip": "TRACE"
  }
}

```

You can turn off with

```auto
PUT /_cluster/settings
{
  "persistent": {
    "logger.org.elasticsearch.ingest.geoip": null
  }
}

```

Then Turn off / on the etc

```auto
PUT _cluster/settings
{
  "transient": {
    "ingest.geoip.downloader.enabled": false
  }
}

PUT _cluster/settings
{
  "transient": {
    "ingest.geoip.downloader.enabled": true
  }
}

PUT _cluster/settings
{
  "transient": {
    "ingest.geoip.downloader.eager.download": true
  }
}

```

The downloader temporarily downloads the files to /tmp which needs to be writeable by the elasticsearch user or perhaps it's out of space

This thread goes through some of the things we tried.

If you read up this thread, you'll see some of the things that we tried.

In the end he loaded manually.

> [@Nginx-ingress-controller-access, \_geoip\_database\_unavailable\_GeoLite2-City.mmdb, \_geoip\_database\_unavailable\_GeoLite2-ASN.mmdb](https://discuss.elastic.co/t/nginx-ingress-controller-access-geoip-database-unavailable-geolite2-city-mmdb-geoip-database-unavailable-geolite2-asn-mmdb/353325/30):
>
> The instructions say On self-managed deployments copy the database files to $ES\_CONFIG/ingest-geoip. Assuming a normal installation Directory layout here /etc/elasticsearch/ingest-geoip

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 22, 2024, 2:42pm UTC](https://discuss.elastic.co/t/geoip2-asn-resolution-in-ingest-pipeline/356093/7 "2024-04-22T14:42:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.