# Update of the Geolite database **URL:** \ **Category:** Logstash\ **Created:** [April 21, 2021, 8:49am UTC](https://discuss.elastic.co/t/update-of-the-geolite-database/270801 "2021-04-21T08:49:24Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Pacous](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pacous/32/86117_2.png) [@Pacous](https://discuss.elastic.co/u/Pacous)\ **Post date:** [April 21, 2021, 8:49am UTC](https://discuss.elastic.co/t/update-of-the-geolite-database/270801/1 "2021-04-21T08:49:24Z")
I configured the Geoip and the Geolite database in logstash. How often do you update the Geolite database? Regards, ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 21, 2021, 1:23pm UTC](https://discuss.elastic.co/t/update-of-the-geolite-database/270801/2 "2021-04-21T13:23:15Z")
> [@Pacous](#): > > How often do you update the Geolite database? A copy of the database is bundled with the plugin. If you want a current copy of the database it is up to you to download it. ---
**Author:** ![Pacous](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pacous/32/86117_2.png) [@Pacous](https://discuss.elastic.co/u/Pacous)\ **Post date:** [April 21, 2021, 1:58pm UTC](https://discuss.elastic.co/t/update-of-the-geolite-database/270801/3 "2021-04-21T13:58:22Z")
> [@Badger](#): > > A copy of the database is bundled with the plugin. If you want a current copy of the database it is up to you to download it. Do you have to download it per week or per month? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 21, 2021, 2:05pm UTC](https://discuss.elastic.co/t/update-of-the-geolite-database/270801/4 "2021-04-21T14:05:39Z")
That is entirely up to you. ---
**Author:** ![Pacous](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pacous/32/86117_2.png) [@Pacous](https://discuss.elastic.co/u/Pacous)\ **Post date:** [April 21, 2021, 2:09pm UTC](https://discuss.elastic.co/t/update-of-the-geolite-database/270801/5 "2021-04-21T14:09:16Z")
> [@Badger](#): > > That is entirely up to you. But, the update is done how often on Maxmind? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 21, 2021, 2:15pm UTC](https://discuss.elastic.co/t/update-of-the-geolite-database/270801/6 "2021-04-21T14:15:29Z")
[Weekly](https://support.maxmind.com/geoip-faq/databases-and-database-updates/how-often-are-the-geoip2-and-geoip-legacy-databases-updated/). ---
**Author:** ![Pacous](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pacous/32/86117_2.png) [@Pacous](https://discuss.elastic.co/u/Pacous)\ **Post date:** [April 21, 2021, 2:18pm UTC](https://discuss.elastic.co/t/update-of-the-geolite-database/270801/7 "2021-04-21T14:18:45Z")
It is therefore necessary to download it every week and restart the logstash service. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 21, 2021, 2:33pm UTC](https://discuss.elastic.co/t/update-of-the-geolite-database/270801/8 "2021-04-21T14:33:09Z")
If you want the latest data then yes, but keep in mind that freely available geoip information is worth about as much as you paid for it. Much of it is warmed over whois data, you will find many address are mapped back to the corporate headquarters of cable companies that no longer exist (having been rolled up into larger companies). And my experience of CDNs is that they get mapped back to the corporate HQ (Cambridge, MA, for Akamai). Many European address appear to be in Amsterdam because that is where RIPE is headquartered. Free geoip data provides a useful hint, it is not fact. ---
**Author:** ![Pacous](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pacous/32/86117_2.png) [@Pacous](https://discuss.elastic.co/u/Pacous)\ **Post date:** [April 21, 2021, 2:45pm UTC](https://discuss.elastic.co/t/update-of-the-geolite-database/270801/9 "2021-04-21T14:45:06Z")
thanks for the information. But, I have a question which has nothing to do with the main topic. I would like to identify malicious IPs, URLs and domain names. How can I configure this in logstash? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 21, 2021, 3:06pm UTC](https://discuss.elastic.co/t/update-of-the-geolite-database/270801/10 "2021-04-21T15:06:39Z")
> [@Pacous](#): > > I would like to identify malicious IPs, URLs and domain names. There are [dozens](https://zeltser.com/malicious-ip-blocklists/) of sites that maintain databases of malicious IPs and URLs. How to convert such a database into something logstash could use would depend upon the database format. ---
**Author:** ![Pacous](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pacous/32/86117_2.png) [@Pacous](https://discuss.elastic.co/u/Pacous)\ **Post date:** [April 21, 2021, 3:26pm UTC](https://discuss.elastic.co/t/update-of-the-geolite-database/270801/11 "2021-04-21T15:26:51Z")
> [@Badger](#): > > There are [dozens](https://zeltser.com/malicious-ip-blocklists/) of sites that maintain databases of malicious IPs and URLs. > > How to convert such a database into something logstash could use would depend upon the database format. Do you have an example logstash configuration for this? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 21, 2021, 4:02pm UTC](https://discuss.elastic.co/t/update-of-the-geolite-database/270801/12 "2021-04-21T16:02:58Z")
> [@Pacous](#): > > Do you have an example logstash configuration for this? I do not. ---
**Author:** ![Pacous](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pacous/32/86117_2.png) [@Pacous](https://discuss.elastic.co/u/Pacous)\ **Post date:** [April 22, 2021, 10:32am UTC](https://discuss.elastic.co/t/update-of-the-geolite-database/270801/13 "2021-04-22T10:32:58Z")
Can you help me please. I don't know how to do this kind of setup ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 20, 2021, 2:58pm UTC](https://discuss.elastic.co/t/update-of-the-geolite-database/270801/15 "2021-05-20T14:58:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.