Using Maxmind databases without access to ES cluster

Elastic Stack Elasticsearch
1

Hi,

I'm using a ES cluster (v8.8.0) running on Kubenetes that is managed by someone else, and I was told by them that I would not be able to directly access the cluster.

Previously, when I was managing my own cluster running on physical servers, I could just put the Maxmind geoloc databases into the $ES_CONFIG/ingest-geoip folder, but it seems like that is no longer possible now.

The "custom endpoint" solution on this page still requires access to the ES cluster in order to change the configuration, so I don't think it would work.

Is there any other way where the ES cluster can still somehow read the Maxmind database without first requiring access to the cluster?

Thank you.

2

Hi @hjazz6
Confused....what has changed?

  1. On self-managed deployments copy the database files to $ES_CONFIG/ingest-geoip.

  2. In your geoip processors, configure the database_file parameter to use a custom database file.

3

Hi @stephenb I'm not able to access the ES nodes to copy the files to $ES_CONFIG/ingest-geoip, nor am I able to configure elasticsearch.yml or run ./bin/elasticsearch-geoip to point to the custom database.

So I'm wondering if I have no access to the ES node, is there any other way to still be able to somehow use the Maxmind databases.

4

Not as far as I know... the methods available are listed on the [page](GeoIP processor | Elasticsearch Guide [8.8] | Elastic you referred to....Somebody needs access to elasticsearch.

I take it you are loading custom files? The defaults get updated every 30 days I believe.

5

Yes, I'll be loading custom files.

May I know if I need to configure every ES node (I have 6 data and 3 master nodes) to point to the custom files (or place the files in every node), or just do it on a few specific nodes, e.g. just the 3 master nodes?

6

Data nodes...
Not master nodes if the masters are master only
If they are master + data nodes then on them too

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.