# SentinelOne integration GeoIP database error

**URL:** <https://discuss.elastic.co/t/sentinelone-integration-geoip-database-error/333262>\
**Category:** SIEM\
**Tags:** elastic-agent\
**Created:** [May 12, 2023, 7:36am UTC](https://discuss.elastic.co/t/sentinelone-integration-geoip-database-error/333262 "2023-05-12T07:36:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Anton\_H](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anton_h/32/10200_2.png) [@Anton\_H](https://discuss.elastic.co/u/Anton_H)\
**Post date:** [May 12, 2023, 7:37am UTC](https://discuss.elastic.co/t/sentinelone-integration-geoip-database-error/333262/1 "2023-05-12T07:37:00Z")

</div>

Hello,

We use the SentinelOne integration through fleet in our Elastic Cloud environment.  
Events are being received and processed.

The issue is we get "\_geoip\_database\_unavailable\_GeoLite2-City.mmdb" errors on all agent logs.  
We use the build-in ingest pipelines, not modifications have been made.  
Other sources like our firewall logs also collected with the build-in integration have no such issues and GeoIP works. I also see no difference between the working and failing GeoIP pipeline section.

I am doubting if the ingest pipeline is the source. The error is only visible as a tag but the pipeline code suggests that there needs to be a field "error.message" with the error. There is no "error.message" field.

Elastic Cloud version: 8.6.2  
Agent version: 8.6.2  
Pipeline: logs-sentinel\_one.agent-1.5.0  
Error: \_geoip\_database\_unavailable\_GeoLite2-City.mmdb

Pipeline code:

```auto
  {
    "geoip": {
      "field": "json.externalIp",
      "target_field": "host.geo",
      "ignore_missing": true,
      "if": "ctx.json?.externalIp != null && ctx.json.externalIp != ''",
      "on_failure": [
        {
          "append": {
            "field": "error.message",
            "value": "{{{_ingest.on_failure_message}}}"
          }
        }
      ]
    }
  },

```

I would appreciate any help.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 13, 2023, 2:10pm UTC](https://discuss.elastic.co/t/sentinelone-integration-geoip-database-error/333262/2 "2023-05-13T14:10:29Z")

</div>

Perhaps try this...

Disable and reenable the geoip databases

> [@\_geoip\_database\_unavailable\_GeoLite2-ASN.mmdb](https://discuss.elastic.co/t/geoip-database-unavailable-geolite2-asn-mmdb/330772/22):
>
> Sorry but that is not the correct part of the logs... there are many many logs perhaps take the file grep -i geo my-application.log and show those results... I am asking internally... I am seeing some inconsistency in 8.7.0... but oddly not with your version the geo dbs loaded right away... BTW this is what geostats should look like... seeing if there is a command to force reload.. curl 'localhost:9200/\_ingest/geoip/stats?pretty' { "stats" : { "successful\_downloads" : 3, "failed\_d…

Also, is that the complete error?

Where are you seeing that?

---

<div class="post-metadata">

**Author:** ![Anton\_H](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anton_h/32/10200_2.png) [@Anton\_H](https://discuss.elastic.co/u/Anton_H)\
**Post date:** [May 13, 2023, 2:34pm UTC](https://discuss.elastic.co/t/sentinelone-integration-geoip-database-error/333262/3 "2023-05-13T14:34:44Z")

</div>

Ok, this is annoying and not at the same time...  
My colleagues upgraded our Elastic Cloud cluster yesterday to 8.7.1 and since May 12th 11:07 we have the first geo\_ip entries.  
So it works now.... 🙂

The error was added as a tag to the events.

Thanks for your response anyway.

At least I learned something new 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 10, 2023, 2:35pm UTC](https://discuss.elastic.co/t/sentinelone-integration-geoip-database-error/333262/4 "2023-06-10T14:35:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.