Logstash geoip download/update

Elastic Stack Logstash
1

I have enabled the following settings in logstash.yml file. When it does detect changes, does it do a full download of the database?

xpack.geoip.downloader.endpoint: "https://geoip.elastic.co/v1/database"
xpack.geoip.downloader.enabled: true

Thanks

Murali

3

If I'm not wrong, yes, it will download the entire database file, I don't think it can download only the changes since there is just a single file for each database.

1 Like
4

Yes. Per the MaxMind documentation, “All updates are provided as complete, new databases, rather than deltas.”

2 Likes
5

They already responded, the database will be downloaded full or nothing.

maxmind.com changed from releasing the GeoIP database under a Creative Commons (CC) license to a proprietary end-user license agreement (EULA). The MaxMind EULA requires Logstash to update the MaxMind database within 30 days of a database update.
After Logstash has switched to a EULA licensed database, the geoip filter will stop enriching events in order to maintain compliance if Logstash fails to check for database updates for 30 days. Events will be tagged with _geoip_expired_database tag to facilitate the handling of this situation. [/quote]

In case you are using the ES GeoIP ingestion plugin, database will expire in 30 days.

6

Thank you all for responding