Ingest GeoIP processor with custom databases (Maxmind Anonymous)

I'm trying to include the Maxmind Anonymous database into my Ingest Pipeline configuration using the Ingest GeoIP processor plugin. Whenever i try to upload the Pipeline configuration i receive the following error:

{"error":{"root_cause":[{"type":"parse_exception","reason":"[properties] illegal property value [NETWORK]. valid values are [ ]","header":{"processor_type":"geoip","property_name":"properties"}}],"type":"parse_exception","reason":"[properties] illegal property value [NETWORK]. valid values are [ ]","header":{"processor_type":"geoip","property_name":"properties"}},"status":400}

My config is as follows:

{"geoip": {
"database_file": "GeoIP2-Anonymous-IP.mmdb",
"properties": ["NETWORK"],
"field": "orig_h",
"target_field": "orig_h_geo"}}

I have tried to use different properties (IS_ANONYMOUS, IS_ANONYMOUS_VPN, ...). When I use other databases such as GeoIP2-City.mmdb the Error message at least tells me which values are valid.

Does anyone know how to fix this issue?


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.