I am trying to setup the geoip filter for logstashin Debian Stretch, as per this question

I installed the geoip-database package, however logstash logs complain of wrong database format. What to do?


It turns out the databases that come with the geoip-database package and that are downloaded by geoip-database-contrib are in a older format not expected by the geoip filter of logstash.

I downloaded the version 2 free database from the maxmind site with the command:

wget http://geolite.maxmind.com/download/geoip/database/GeoLite2-City.mmdb.gz
gunzip GeoLite2-City.mmdb.gz
mv GeoLite2-City.mmdb /etc/logstash/GeoLiteCity.dat

Restarted logstash, and now it does not complain about the GeoLite file being in the wrong format.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.