How does geoip filter works when geo database file updated

Elastic Stack Logstash
#1

Hello,

We're looking to make our GeoLite Database being updated automatically at regular interval.

How is behaving LS - geoip filter when file is updated?

  • is it crashing?
  • is the new database taken automatically or LS restart mandatory?

Thanks
Bruno Lavoie

#2

I don't believe it caches anything in memory itself, so you can probably replace it manually, but you should test this first!

#3

We do something similar. For whatever reason we didn't see it take effect until Logstash was restarted. But we were only looking at one very common IP in our logs.

If you check the documentation there is a config value you can set. Sounds like it does cache a certain amount of IP's. I have no idea how long it stays in there though before being evicted though. Could be a few minutes, could be forever. It is outside of my expertise.

#4