says:
If you work in air-gapped environment and want to disable the database auto-update feature, set the xpack.geoip.downloader.enabled value to false in logstash.yml.
So I set that, and now Logstash won't start and the configuration test fails.
[logstash@ls-index-you-give:test:~]$ /usr/share/logstash/bin/logstash --version
Using bundled JDK: /usr/share/logstash/jdk
logstash 7.17.27
[logstash@ls-index-you-give:test:~]$ /usr/share/logstash/bin/logstash --path.settings /etc/logstash -t
Using bundled JDK: /usr/share/logstash/jdk
OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties
Your settings are invalid. Reason: Setting "xpack.geoip.downloader.enabled" hasn't been registered
[logstash@ls-index-you-give:test:~]$
As far as I can determine "hasn't been registered" is what Logstash says when it encounters a configuration setting which it doesn't know what to do with. But that configuration setting is in the Logstash documentation. Can anyone explain what's going on here please?
[root@ls-index-you-give:test:~]$ rpm -qi logstash
Name : logstash
Epoch : 1
Version : 7.17.27
Release : 1
Architecture: x86_64
Install Date: Thu 13 Feb 2025 15:32:32 GMT
Group : default
Size : 628579312
License : Elastic License
Signature : RSA/SHA512, Thu 09 Jan 2025 15:19:32 GMT, Key ID d27d666cd88e42b4
Source RPM : logstash-7.17.27-1.src.rpm
Build Date : Tue 07 Jan 2025 17:59:19 GMT
Build Host : bk-agent-prod-gcp-1736272127217008470.c.elastic-ci-prod.internal
Relocations : /
Packager : <buildkite-agent@bk-agent-prod-gcp-1736272127217008470>
Vendor : Elastic
URL : https://www.elastic.co/logstash
Summary : An extensible logging pipeline
Description :
An extensible logging pipeline
[root@ls-index-you-give:test:~]$ grep -v ^# /etc/logstash/logstash.yml
node.name: indexer_you-give
path.data: /var/lib/logstash
pipeline.workers: 1
pipeline.batch.size: 125
pipeline.batch.delay: 5
pipeline.unsafe_shutdown: false
config.reload.automatic: false
config.reload.interval: 60
queue.type: memory
queue.page_capacity: 250mb
queue.max_events: 0
queue.max_bytes: 1024mb
queue.checkpoint.acks: 1024
queue.checkpoint.writes: 1024
queue.checkpoint.interval: 1000
dead_letter_queue.enable: true
dead_letter_queue.max_bytes: 5120mb
path.dead_letter_queue: /data/logstash_dead_letter_queue
log.level: info
path.logs: /var/log/logstash
pipeline.ecs_compatibility: disabled
xpack.geoip.downloader.enabled: false
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.hosts: [""https://foo.bar:9200"]
xpack.monitoring.elasticsearch.username: logstash_monitoring
xpack.monitoring.elasticsearch.password: redact
[root@ls-index-you-give:test:~]$