# New GeoIP ingest processor is missing databases, but existing GeoIP processors work fine **URL:** \ **Category:** Elasticsearch\ **Tags:** ingest-pipeline\ **Created:** [December 2, 2022, 2:58pm UTC](https://discuss.elastic.co/t/new-geoip-ingest-processor-is-missing-databases-but-existing-geoip-processors-work-fine/320381 "2022-12-02T14:58:05Z")\ **Posts on this page:** 1\ **Showing post:** 6
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 5, 2022, 8:02pm UTC](https://discuss.elastic.co/t/new-geoip-ingest-processor-is-missing-databases-but-existing-geoip-processors-work-fine/320381/6 "2022-12-05T20:02:11Z")
> [@twilson](#): > > Will these databases update automatically or do I need to use the directions ([GeoIP processor | Elasticsearch Guide [master] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/master/geoip-processor.html#manually-update-geoip-databases)) for manually updating the databases on the non-ingest and coordinator nodes? I guess I'll check the logs on Thursday to see if they are updating automatically. They will get updated automatically assuming you have connectivity and have set `ingest.geoip.downloader.enabled : true` in your elasticsearch.yml (actuall that is the default just don't set to false). The Exact schedule I do not have the schedule / process at my finger tips ... Not sure why you are thinking thursday they are updated initially when a node is started then I think the MaxMind are updated Bi-Weekly or something ... and there is a 30 day window... this all happens automatically as the default behavior > By default, the processor uses the GeoLite2 City, GeoLite2 Country, and GeoLite2 ASN GeoIP2 databases from [MaxMind](http://dev.maxmind.com/geoip/geoip2/geolite2/), shared under the CC BY-SA 4.0 license. **Elasticsearch automatically downloads updates for these databases from the Elastic GeoIP endpoint:** [https://geoip.elastic.co/v1/database](https://geoip.elastic.co/v1/database). To get download statistics for these updates, use the [GeoIP stats API](https://www.elastic.co/guide/en/elasticsearch/reference/master/geoip-stats-api.html). > If your cluster can’t connect to the Elastic GeoIP endpoint or you want to manage your own updates, see [Manage your own GeoIP2 database updates](https://www.elastic.co/guide/en/elasticsearch/reference/master/geoip-processor.html#manage-geoip-database-updates). > > If Elasticsearch can’t connect to the endpoint for 30 days all updated databases will become invalid. Elasticsearch will stop enriching documents with geoip data and will add `tags: ["_geoip_expired_database"]` field instead. > [@twilson](#): > > If the GeoIP processors is actually an enrichment processor, why isn't elasticsearch smart enough to figure out that the databases need to be available on all the data, ingest, and coordinator nodes? I have used the enrichment processor for other purposes and the data is automatically stored on all the nodes. That is a looooong discussion and it is recognized as an issue but it goes something like this. Data nodes hold Data / Indices Ingest Nodes by role / definition Do Not Hold Data Enrich Policies are Data Indices (geoIP included) So the enrich policies which are Data / Indices live on Data nodes (not Ingest Nodes) and are accessed by Ingest Nodes / Pipelines that reach out to the Data Nodes. The Engineering / Product team recognizes this and I think is working on a solution as part of a larger ingest processing theme, the current behavior is a byproduct of strong node roles.... > [@twilson](#): > > Why were the existing/managed GeoIP ingest processors still working without any problems and this only impacting new GeoIP processors? This is really the biggest question I have. No Clue... perhaps those indices were still on the Data Nodes... --- _[View the full topic](https://discuss.elastic.co/t/new-geoip-ingest-processor-is-missing-databases-but-existing-geoip-processors-work-fine/320381)._