# How does geoip filter works when geo database file updated

**URL:** <https://discuss.elastic.co/t/how-does-geoip-filter-works-when-geo-database-file-updated/44044>\
**Category:** Logstash\
**Created:** [March 10, 2016, 2:24pm UTC](https://discuss.elastic.co/t/how-does-geoip-filter-works-when-geo-database-file-updated/44044 "2016-03-10T14:24:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bruno\_Lavoie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bruno_lavoie/32/8408_2.png) [@Bruno\_Lavoie](https://discuss.elastic.co/u/Bruno_Lavoie)\
**Post date:** [March 10, 2016, 2:24pm UTC](https://discuss.elastic.co/t/how-does-geoip-filter-works-when-geo-database-file-updated/44044/1 "2016-03-10T14:24:34Z")

</div>

Hello,

We're looking to make our GeoLite Database being updated automatically at regular interval.

How is behaving LS - geoip filter when file is updated?

- is it crashing?
- is the new database taken automatically or LS restart mandatory?

Thanks  
Bruno Lavoie

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 12, 2016, 2:45am UTC](https://discuss.elastic.co/t/how-does-geoip-filter-works-when-geo-database-file-updated/44044/2 "2016-03-12T02:45:33Z")

</div>

I don't believe it caches anything in memory itself, so you can probably replace it manually, but you should test this first!

---

<div class="post-metadata">

**Author:** ![bhatch](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@bhatch](https://discuss.elastic.co/u/bhatch)\
**Post date:** [March 14, 2016, 4:53pm UTC](https://discuss.elastic.co/t/how-does-geoip-filter-works-when-geo-database-file-updated/44044/3 "2016-03-14T16:53:42Z")

</div>

We do something similar. For whatever reason we didn't see it take effect until Logstash was restarted. But we were only looking at one very common IP in our logs.

If you check the documentation there is a [config value](https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html#plugins-filters-geoip-lru_cache_size) you can set. Sounds like it does cache a certain amount of IP's. I have no idea how long it stays in there though before being evicted though. Could be a few minutes, could be forever. It is outside of my expertise.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:07am UTC](https://discuss.elastic.co/t/how-does-geoip-filter-works-when-geo-database-file-updated/44044/4 "2017-07-06T05:07:07Z")

</div>