# How to update the geoip with the new? **URL:** \ **Category:** Elasticsearch\ **Created:** [March 16, 2018, 5:19am UTC](https://discuss.elastic.co/t/how-to-update-the-geoip-with-the-new/124205 "2018-03-16T05:19:25Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 16, 2018, 5:19am UTC](https://discuss.elastic.co/t/how-to-update-the-geoip-with-the-new/124205/1 "2018-03-16T05:19:25Z")
how to update the geoip with the new? can give a docs? i find some iP in my geoip can't output the city. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 16, 2018, 9:16am UTC](https://discuss.elastic.co/t/how-to-update-the-geoip-with-the-new/124205/2 "2018-03-16T09:16:53Z")
Can you provide an example of a problematic document? ---
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 19, 2018, 6:47am UTC](https://discuss.elastic.co/t/how-to-update-the-geoip-with-the-new/124205/3 "2018-03-19T06:47:34Z")
thi ip is like 223.104.254.1 can't use geoip match city. only china CN the city is bejing. @Christian_Dahlqvist ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 19, 2018, 7:13am UTC](https://discuss.elastic.co/t/how-to-update-the-geoip-with-the-new/124205/4 "2018-03-19T07:13:45Z")
Is the problem is that the mapping is not correct for China when using the open-source version of the Geolite2 database? If that is the case, the geoip plugin also supports commercial databases from MaxMind, which may contain better mappings for your region. ---
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 19, 2018, 7:15am UTC](https://discuss.elastic.co/t/how-to-update-the-geoip-with-the-new/124205/5 "2018-03-19T07:15:37Z")
yes i know .i wan't to know how to use the last new Geolite2 database in elasticsearch thanks. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 19, 2018, 7:21am UTC](https://discuss.elastic.co/t/how-to-update-the-geoip-with-the-new/124205/6 "2018-03-19T07:21:15Z")
Have you tried downloading it from the MaxMind website and configure the geoip plugin to use it? ---
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 19, 2018, 7:23am UTC](https://discuss.elastic.co/t/how-to-update-the-geoip-with-the-new/124205/7 "2018-03-19T07:23:44Z")
no ,i don't know how do about it .so need help. how configure the geoip plugin .with MaxMind i don't know. can give a doc? thanks. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 19, 2018, 7:33am UTC](https://discuss.elastic.co/t/how-to-update-the-geoip-with-the-new/124205/8 "2018-03-19T07:33:47Z")
[https://www.elastic.co/guide/en/elasticsearch/plugins/current/using-ingest-geoip.html](https://www.elastic.co/guide/en/elasticsearch/plugins/current/using-ingest-geoip.html) [https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html) ---
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 19, 2018, 7:35am UTC](https://discuss.elastic.co/t/how-to-update-the-geoip-with-the-new/124205/9 "2018-03-19T07:35:15Z")
with logstash in data to es the logstash need update the plugin? [https://www.elastic.co/guide/en/logstash/5.6/plugins-filters-geoip.html](https://www.elastic.co/guide/en/logstash/5.6/plugins-filters-geoip.html) ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 19, 2018, 7:38am UTC](https://discuss.elastic.co/t/how-to-update-the-geoip-with-the-new/124205/10 "2018-03-19T07:38:50Z")
There are two geoip plugins, one for Logstash and one for ingest node. Pick the one that is appropriate. I believe you will need to manually download a new database and then configure the plugin ton use this. ---
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 19, 2018, 7:40am UTC](https://discuss.elastic.co/t/how-to-update-the-geoip-with-the-new/124205/11 "2018-03-19T07:40:11Z")
ok i will use logstash to test it now data from logstash to es. thanks. ---
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 19, 2018, 7:46am UTC](https://discuss.elastic.co/t/how-to-update-the-geoip-with-the-new/124205/12 "2018-03-19T07:46:55Z")
in [https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html#plugins-filters-geoip-database](https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html#plugins-filters-geoip-database) ``` database Value type is path There is no default value for this setting. The path to Maxmindโ€™s database file that Logstash should use. The default database is GeoLite2-City. GeoLite2-City, GeoLite2-Country, GeoLite2-ASN are the free databases from Maxmind that are supported. GeoIP2-City, GeoIP2-ISP, GeoIP2-Country are the commercial databases from Maxmind that are supported. If not specified, **this will default to the GeoLite2 City database that ships with Logstash**. ``` i find this i won't to know where to use default Geolite2 database . i can copy the GeoLite2-City file replacte to the default with logstash? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 19, 2018, 7:50am UTC](https://discuss.elastic.co/t/how-to-update-the-geoip-with-the-new/124205/13 "2018-03-19T07:50:23Z")
Have you downloaded a new database from the maxMind web site? If so, place this in a suitable path and use this path when configuring the plugin. ---
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 19, 2018, 7:53am UTC](https://discuss.elastic.co/t/how-to-update-the-geoip-with-the-new/124205/14 "2018-03-19T07:53:12Z")
OK this have three from [https://dev.maxmind.com/geoip/geoip2/geolite2/](https://dev.maxmind.com/geoip/geoip2/geolite2/) Downloads GeoLite2 City GeoLite2 Country GeoLite2 ASN (Autonomous System Number) all down or use city and country? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 19, 2018, 7:55am UTC](https://discuss.elastic.co/t/how-to-update-the-geoip-with-the-new/124205/15 "2018-03-19T07:55:29Z")
As indicated by the documentation, Logstash uses the City database by default. I have not tried using any of the others, so am not sure whether they are compatible or not. ---
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 19, 2018, 7:57am UTC](https://discuss.elastic.co/t/how-to-update-the-geoip-with-the-new/124205/16 "2018-03-19T07:57:24Z")
ok i will try thanks so much :elasticheart:๐Ÿ˜๐Ÿ˜๐Ÿ˜ ---
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 20, 2018, 1:06am UTC](https://discuss.elastic.co/t/how-to-update-the-geoip-with-the-new/124205/17 "2018-03-20T01:06:26Z")
i update te geoip city database it know can output the city thanks. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 17, 2018, 1:06am UTC](https://discuss.elastic.co/t/how-to-update-the-geoip-with-the-new/124205/18 "2018-04-17T01:06:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.