They will get updated automatically assuming you have connectivity and have set ingest.geoip.downloader.enabled : true in your elasticsearch.yml (actuall that is the default just don't set to false).
The Exact schedule I do not have the schedule / process at my finger tips ... Not sure why you are thinking thursday they are updated initially when a node is started then I think the MaxMind are updated Bi-Weekly or something ... and there is a 30 day window... this all happens automatically as the default behavior
By default, the processor uses the GeoLite2 City, GeoLite2 Country, and GeoLite2 ASN GeoIP2 databases from MaxMind, shared under the CC BY-SA 4.0 license. Elasticsearch automatically downloads updates for these databases from the Elastic GeoIP endpoint: https://geoip.elastic.co/v1/database. To get download statistics for these updates, use the GeoIP stats API.
If your cluster can’t connect to the Elastic GeoIP endpoint or you want to manage your own updates, see Manage your own GeoIP2 database updates.
If Elasticsearch can’t connect to the endpoint for 30 days all updated databases will become invalid. Elasticsearch will stop enriching documents with geoip data and will add
tags: ["_geoip_expired_database"]field instead.
That is a looooong discussion and it is recognized as an issue but it goes something like this.
Data nodes hold Data / Indices
Ingest Nodes by role / definition Do Not Hold Data
Enrich Policies are Data Indices (geoIP included)
So the enrich policies which are Data / Indices live on Data nodes (not Ingest Nodes) and are accessed by Ingest Nodes / Pipelines that reach out to the Data Nodes.
The Engineering / Product team recognizes this and I think is working on a solution as part of a larger ingest processing theme, the current behavior is a byproduct of strong node roles....
No Clue... perhaps those indices were still on the Data Nodes...