[2024-06-13T11:02:33,820][INFO ][logstash.filters.geoip.downloadmanager] new database version detected? true
[2024-06-13T11:02:36,516][INFO ][logstash.filters.geoip.databasemanager] geoip plugin will use database /usr/share/logstash/data/plugins/filters/geoip/1718276553/GeoLite2-City.mmdb {:database_type=>"City", :pipeline_ids=>["main", "main"]}
[2024-06-13T11:02:36,524][INFO ][logstash.filters.geoip.databasemanager] /usr/share/logstash/data/plugins/filters/geoip/1718103737 is deleted
[2024-06-14T11:02:46,540][ERROR][logstash.filters.geoip.databasemanager] Read timed out {:cause=>#<Java::JavaNet::SocketTimeoutException: Read timed out>}
[2024-06-15T11:02:46,736][INFO ][logstash.filters.geoip.downloadmanager] new database version detected? true
[2024-06-15T11:02:49,057][INFO ][logstash.filters.geoip.databasemanager] geoip plugin will use database /usr/share/logstash/data/plugins/filters/geoip/1718449366/GeoLite2-City.mmdb {:database_type=>"City", :pipeline_ids=>["main", "main"]}
[2024-06-15T11:02:49,067][INFO ][logstash.filters.geoip.databasemanager] /usr/share/logstash/data/plugins/filters/geoip/1718276553 is deleted
[2024-06-16T11:02:59,082][ERROR][logstash.filters.geoip.databasemanager] Read timed out {:cause=>#<Java::JavaNet::SocketTimeoutException: Read timed out>}
I went through this document verified Geoip filter plugin | Logstash Reference [8.14] | Elastic
I understand the value by default is enabled for xpack.geoip.downloader.enabled howver the logstash.yml does not have this entry
cat logstash.yml
path.logs: /usr/share/logstash/logs
log.format: plain
pipeline.ecs_compatibility: disabled