yes sir, tried with jvm options. so other option we might to need look into is manual updation. But i didnt find any url to download those .mmdb files.
whether we need to create an account to download those files?
Yes you will, I did when I tested last year... You will need to create an account except the terms and then download from their site
Did you try the trace logs to see if there was any more specific/ details that could help?
The issue you're experiencing with missing geolocation tags in your Nginx ingress controller logs, indicated by the tags _geoip_database_unavailable_GeoLite2-City.mmdb and _geoip_database_unavailable_GeoLite2-ASN.mmdb , suggests that the GeoIP databases required for geolocation enrichment are not accessible or available in your Elastic Agent setup on Kubernetes. The commands you've tried aim to toggle the GeoIP database downloader, but if the problem persists, it could be due to either network restrictions preventing the download of GeoIP databases or a misconfiguration in the Elastic Agent or the Ingest pipelines. To resolve this, ensure that your Elastic Agent has internet access to download the GeoIP databases or manually download and configure the GeoIP databases in the expected location. Additionally, verify that your ingest pipelines that utilize GeoIP processors are correctly configured and pointing to the location of the GeoIP databases.
sir.. i have downloaded the .mmdb files how to proceed further?
~/geoip_downloaded$ ls
COPYRIGHT.txt GeoLite2-City.mmdb GeoLite2-Country.mmdb LICENSE.txt
elastic-geoip-database-service-agreement-LICENSE.txt GeoLite2-City.tgz GeoLite2-Country.tgz README.txt
As per the instructions i have copied the .mmdb files in /usr/share/elasticsearch/modules/ingest-geoip/ in all the data nodes.
i didnt get how to configure the custom database_file in our geoip processor as per the below instruction.
"In your geoip processors, configure the database_file parameter to use a custom database file."
root@elk01:/home/cept# cd /usr/share/elasticsearch/modules/ingest-geoip/
root@elk01:/usr/share/elasticsearch/modules/ingest-geoip# ls
COPYRIGHT.txt GeoLite2-Country.tgz maxmind-db-3.0.0.jar
elastic-geoip-database-service-agreement-LICENSE.txt ingest-geoip-8.11.4.jar plugin-descriptor.properties
geoip2-4.0.0.jar jackson-annotations-2.15.0.jar plugin-security.policy
GeoLite2-City.mmdb jackson-core-2.15.0.jar README.txt
GeoLite2-City.tgz jackson-databind-2.15.0.jar
GeoLite2-Country.mmdb LICENSE.txt
root@elk01:/usr/share/elasticsearch/modules/ingest-geoip# ls -lrt *.mmdb
-rw-r--r-- 1 root root 57755153 Mar 13 15:08 GeoLite2-City.mmdb
-rw-r--r-- 1 root root 6438391 Mar 13 15:08 GeoLite2-Country.mmdb
Since it looks like you are the default database file name looks
I do not think you need to set it.
You set it in the geoip processor examples are on the same doc page I referred you to.
Field. Required Default
database_file. no GeoLite2-City.mmdb
PUT _ingest/pipeline/geoip
{
"description" : "Add geoip info",
"processors" : [
{
"geoip" : {
"field" : "ip",
"target_field" : "geo",
"database_file" : "GeoLite2-City.mmdb"
}
}
]
i gave the the field name as source.ip and tried with a single doc to test the pipeline but still getting error as database unavailable..
"source": {
"address": "106.216.235.73",
"ip": "106.216.235.73"
},
"url": {
"path": "/asp/api/v2/apswo",
"original": "/asp/api/v2/apswo"
},
"tags": [
"nginx-ingress-controller-access",
"_geoip_database_unavailable_GeoLite2-City.mmdb",
"_geoip_database_unavailable_GeoLite2-ASN.mmdb",
"_geoip_database_unavailable_GeoLite2-Country.mmdb"
],
Whether is it required to rename the downloaded database files?
or the database files that i have copied in the path /usr/share/elasticsearch/modules/ingest-geoip/ whether path is correct or not?
The instructions say
On self-managed deployments copy the database files to $ES_CONFIG/ingest-geoip.
Assuming a normal installation
Directory layout here
/etc/elasticsearch/ingest-geoip
Copied the downloaded database files .mmdb to the /etc/elasticsearch/ingest-geoip on all the data nodes and configured custom pipeline. And it`s working fine. Thanks sir
1 Like
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.