# How does the new (7.14+) GeoIP Processor Work?

**URL:** <https://discuss.elastic.co/t/how-does-the-new-7-14-geoip-processor-work/289957>\
**Category:** Elasticsearch\
**Tags:** ingest-pipeline\
**Created:** [November 23, 2021, 2:09pm UTC](https://discuss.elastic.co/t/how-does-the-new-7-14-geoip-processor-work/289957 "2021-11-23T14:09:04Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![BenB196](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benb196/32/83401_2.png) [@BenB196](https://discuss.elastic.co/u/BenB196)\
**Post date:** [November 23, 2021, 2:09pm UTC](https://discuss.elastic.co/t/how-does-the-new-7-14-geoip-processor-work/289957/1 "2021-11-23T14:09:04Z")

</div>

Hi,

In 7.14+ Elasticsearch enabled the GeoIP downloader and made the DB reloadable. But I was wondering how does this actually work. Looking at the [docs](https://www.elastic.co/guide/en/elasticsearch/reference/current/geoip-processor.html), it seems like all this process does now is download the DB file, read that DB file into an index, then use an abstracted [enrich processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/enrich-processor.html). Is this correct, or is this process different?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [November 23, 2021, 3:45pm UTC](https://discuss.elastic.co/t/how-does-the-new-7-14-geoip-processor-work/289957/2 "2021-11-23T15:45:33Z")

</div>

Hi @BenB196

Generally your understanding is correct, the downloader etc was created to meet [the new license requirements for MaxMind GeoLite2 database](https://www.maxmind.com/en/geolite2/eula) which requires that the DB is kept up to date. Also it is a separate piece of code than the normal enrich processor but in the broadest sense yes it is "enriching".

---

<div class="post-metadata">

**Author:** ![BenB196](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benb196/32/83401_2.png) [@BenB196](https://discuss.elastic.co/u/BenB196)\
**Post date:** [November 23, 2021, 4:37pm UTC](https://discuss.elastic.co/t/how-does-the-new-7-14-geoip-processor-work/289957/3 "2021-11-23T16:37:03Z")

</div>

Thanks @stephenb, two follow-up questions.

1. Does it have the same performance as a regular enrich processor, or is it more performant?
2. It appears that most of the GeoIP stuff is roughly hard-coded to only really work with MaxMind stuff. Are there any plans to genericize this to support other downloadable files from other endpoints, as well as support other fields?
  - The reason I ask this is because right now, if I want to load a file into Elasticsearch to be used as in enrich processor, I need to effectively do something like: Logstash/Filebeat -\> Elasticsearch -\> Figure out some way to call enrich update API. It'd be nice to have something more natively supported in Elasticsearch.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [November 23, 2021, 4:47pm UTC](https://discuss.elastic.co/t/how-does-the-new-7-14-geoip-processor-work/289957/4 "2021-11-23T16:47:42Z")

</div>

1. Yes I suspect it has as good or better than regular Enrich.

2. 

> [@BenB196](#):
>
> Are there any plans to genericize this to support other downloadable files from other endpoints, as well as support other fields?

> [@BenB196](#):
>
> It'd be nice to have something more natively supported in Elasticsearch.

Not as far as I know, but please feel free to file a feature enhancement.

---

<div class="post-metadata">

**Author:** ![BenB196](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benb196/32/83401_2.png) [@BenB196](https://discuss.elastic.co/u/BenB196)\
**Post date:** [November 23, 2021, 6:00pm UTC](https://discuss.elastic.co/t/how-does-the-new-7-14-geoip-processor-work/289957/5 "2021-11-23T18:00:24Z")

</div>

Thanks for the information on this @stephenb

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 21, 2021, 6:00pm UTC](https://discuss.elastic.co/t/how-does-the-new-7-14-geoip-processor-work/289957/6 "2021-12-21T18:00:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
