# Logstash geoip download/update

**URL:** <https://discuss.elastic.co/t/logstash-geoip-download-update/383241>\
**Category:** Logstash\
**Created:** [November 5, 2025, 12:48pm UTC](https://discuss.elastic.co/t/logstash-geoip-download-update/383241 "2025-11-05T12:48:53Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![murali\_vraman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/murali_vraman/32/138142_2.png) [@murali\_vraman](https://discuss.elastic.co/u/murali_vraman)\
**Post date:** [November 5, 2025, 12:48pm UTC](https://discuss.elastic.co/t/logstash-geoip-download-update/383241/1 "2025-11-05T12:48:53Z")

</div>

I have enabled the following settings in logstash.yml file. When it does detect changes, does it do a full download of the database?

```auto
xpack.geoip.downloader.endpoint: "https://geoip.elastic.co/v1/database"
xpack.geoip.downloader.enabled: true

```

Thanks

Murali

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [November 5, 2025, 2:14pm UTC](https://discuss.elastic.co/t/logstash-geoip-download-update/383241/3 "2025-11-05T14:14:28Z")

</div>

> [@murali\_vraman](#):
>
> When it does detect changes, does it do a full download of the database?

If I'm not wrong, yes, it will download the entire database file, I don't think it can download only the changes since there is just a single file for each database.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 5, 2025, 3:32pm UTC](https://discuss.elastic.co/t/logstash-geoip-download-update/383241/4 "2025-11-05T15:32:45Z")

</div>

> [@murali\_vraman](#):
>
> When it does detect changes, does it do a full download of the database?

Yes. Per the MaxMind [documentation](https://support.maxmind.com/knowledge-base/articles/download-and-update-maxmind-databases), “All updates are provided as complete, new databases, rather than deltas.”

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [November 5, 2025, 6:34pm UTC](https://discuss.elastic.co/t/logstash-geoip-download-update/383241/5 "2025-11-05T18:34:19Z")

</div>

They already responded, the database will be downloaded full or nothing.

> [maxmind.com](http://maxmind.com) changed from releasing the GeoIP database under a Creative Commons (CC) license to a proprietary end-user license agreement (EULA). The MaxMind EULA requires Logstash to update the MaxMind database within 30 days of a database update.  
> After Logstash has switched to a EULA licensed database, the geoip filter will stop enriching events in order to maintain compliance if Logstash fails to check for database updates for 30 days. Events will be tagged with `_geoip_expired_database` tag to facilitate the handling of this situation. [/quote]

In case you are using the ES GeoIP ingestion plugin, database will expire in 30 days.

> [@Elastic documentation](#):
>
> If Elasticsearch can’t connect to the endpoint for 30 days all updated databases will become invalid

---

<div class="post-metadata">

**Author:** ![murali\_vraman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/murali_vraman/32/138142_2.png) [@murali\_vraman](https://discuss.elastic.co/u/murali_vraman)\
**Post date:** [November 6, 2025, 3:20pm UTC](https://discuss.elastic.co/t/logstash-geoip-download-update/383241/6 "2025-11-06T15:20:57Z")

</div>

Thank you all for responding