I am trying to setup the
geoip filter for
logstashin Debian Stretch, as per this question
I installed the
geoip-database package, however
logstash logs complain of wrong database format. What to do?
It turns out the databases that come with the
geoip-database package and that are downloaded by
geoip-database-contrib are in a older format not expected by the
geoip filter of
I downloaded the version 2 free database from the maxmind site with the command:
wget http://geolite.maxmind.com/download/geoip/database/GeoLite2-City.mmdb.gz gunzip GeoLite2-City.mmdb.gz mv GeoLite2-City.mmdb /etc/logstash/GeoLiteCity.dat
Restarted logstash, and now it does not complain about the GeoLite file being in the wrong format.