# Try to enable geoip on logstash **URL:** \ **Category:** Logstash\ **Created:** [May 28, 2020, 2:19pm UTC](https://discuss.elastic.co/t/try-to-enable-geoip-on-logstash/234763 "2020-05-28T14:19:27Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![rocanelo](https://avatars.discourse-cdn.com/v4/letter/r/a9a28c/32.png) [@rocanelo](https://discuss.elastic.co/u/rocanelo)\ **Post date:** [May 28, 2020, 2:19pm UTC](https://discuss.elastic.co/t/try-to-enable-geoip-on-logstash/234763/1 "2020-05-28T14:19:27Z")
Hi everyone, I'm try to enable geoip on my logstash but have a message say the database is corrupted, I suscribe to maxmind and get the last database, I upgdate with command "geoupdate" but not working. I dont now what more see or do to solve the issue. Thanks a lot. \*\*\*\*\*\*\*\*\*config \*\*\*\*\*\*\*\*\* input { syslog { port =\> 2514 } } filter { kv { field\_split =\> "|" } geoip { source =\> "src" target =\> "geoip" database =\> "/usr/share/GeoIP/GeoIP.dat" add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ] add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ] } } output { elasticsearch { hosts =\> ["127.0.0.1:9200"] hosts =\> "127.0.0.1:9200" manage\_template =\> false index =\> "[cp\_cena]-%{+YYYY.MM.dd}" } file { path =\> "/tmp/output.log" codec =\> rubydebug } } \*\*\ ***Message LOG** [2020-05-28T02:04:10,206][INFO][logstash.filters.geoip][main] Using geoip database {:path=\>"/usr/share/GeoIP/GeoIP.dat"} [2020-05-28T02:04:10,291][ERROR][logstash.javapipeline][main] Pipeline aborted due to error {:pipeline\_id=\>"main", :exception=\>java.lang.IllegalArgumentException: The database provided is invalid or corrupted., :backtrace=\>["org.logstash.filters.GeoIPFilter.(org/logstash/filters/GeoIPFilter.java:72)", "java.lang.reflect.Constructor.newInstance(java/lang/reflect/Constructor.java:423)", "org.jruby.javasupport.JavaConstructor.newInstanceDirect(org/jruby/javasupport/JavaConstructor.java:253)", "org.jruby.RubyClass.newInstance(org/jruby/RubyClass.java:939)", "org.jruby.RubyClass$INVOKER$i$newInstance.call(org/jruby/RubyClass$INVOKER$i$newInstance.gen)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_5\_dot\_0.gems.logstash\_minus\_filter\_minus\_geoip\_minus\_6\_dot\_0\_dot\_3\_minus\_java.lib.logstash.filters.geoip.register(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-6.0.3-java/lib/logstash/filters/geoip.rb:103)", "org.jruby.RubyClass.finvoke(org/jruby/RubyClass.java:572)", "org.jruby.RubyBasicObject.callMethod(org/jruby/RubyBasicObject.java:354)", "org.logstash.config.ir.compiler.FilterDelegatorExt.doRegister(org/logstash/config/ir/compiler/FilterDelegatorExt.java:88)", "org.logstash.config.ir.compiler.AbstractFilterDelegatorExt.register(org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:75)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.java\_pipeline.register\_plugins(/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:216)", "org.jruby.RubyArray.each(org/jruby/RubyArray.java:1809)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.java\_pipeline.register\_plugins(/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:215)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.java\_pipeline.RUBY$method$register\_plugins$0$ **VARARGS** (usr/share/logstash/logstash\_minus\_core/lib/logstash//usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.java\_pipeline.maybe\_setup\_out\_plugins(/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:521)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.java\_pipeline.RUBY$method$maybe\_setup\_out\_plugins$0$ **VARARGS** (usr/share/logstash/logstash\_minus\_core/lib/logstash//usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.java\_pipeline.start\_workers(/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:228)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.java\_pipeline.RUBY$method$start\_workers$0$ **VARARGS** (usr/share/logstash/logstash\_minus\_core/lib/logstash//usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.java\_pipeline.run(/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:170)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.java\_pipeline.RUBY$method$run$0$ **VARARGS** (usr/share/logstash/logstash\_minus\_core/lib/logstash//usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.java\_pipeline.start(/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:125)", "org.jruby.RubyProc.call(org/jruby/RubyProc.java:318)", "java.lang.Thread.run(java/lang/Thread.java:748)"], "pipeline.sources"=\>["/etc/logstash/conf.d/udp2514.conf"], :thread=\>"#\"} [2020-05-28T02:04:10,320][ERROR][logstash.agent] Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Could not execute action: PipelineAction::Create, action\_result: false", :backtrace=\>nil} [2020-05-28T02:04:10,685][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} [2020-05-28T02:04:15,566][INFO][logstash.runner] Logstash shut down. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 29, 2020, 1:31am UTC](https://discuss.elastic.co/t/try-to-enable-geoip-on-logstash/234763/2 "2020-05-29T01:31:42Z")
We do support the MaxMind databases, [as per the docs](https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html#_supported_databases), but perhaps there's a change in their format we aren't aware of? It might be worth raising an issue on the plugin GitHub repo 🙂 ---
**Author:** ![rocanelo](https://avatars.discourse-cdn.com/v4/letter/r/a9a28c/32.png) [@rocanelo](https://discuss.elastic.co/u/rocanelo)\ **Post date:** [May 29, 2020, 4:33am UTC](https://discuss.elastic.co/t/try-to-enable-geoip-on-logstash/234763/3 "2020-05-29T04:33:22Z")
Thanks for the info. I apply the next config and solve the problem: database =\> "/usr/share/GeoIP/GeoLite2-City.mmdb" ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 26, 2020, 4:33am UTC](https://discuss.elastic.co/t/try-to-enable-geoip-on-logstash/234763/4 "2020-06-26T04:33:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.