You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The ask in this feature request is to add support for more databases, specifically my case would be the DB-IP Location + ISP database, but it seems others would like the rest of the paid MaxMind databases as well.
It looks like the GeoIP filter can read the file but it expects a different schema for the data and therefore fails out when trying to use the DB-IP database in the GeoIP filter with the database option.
They also link to a MaxMind code library to read MMDB's which when I attempted to read the DB-IP database it wanted to use the Enterprise database reader, which at the moment doesn't appear to be supported by the GeoIP Filter.
I don't have access to a MaxMind Enterprise database so I couldn't check if to see the schema is similar or not, but the library seems to think so.
Also, it looks like the GeoIP filter does not recognize that MaxMind has added additional databases, such as the Enterprise, Anonymous IP, Connection Type, and Domain, all of which are paid MaxMind databases. Info for these databases can be found here: https://dev.maxmind.com/
Finally, here is a sample of data that I was able to pull using MaxMind's Python MMDB file reader inputting the IP 1.1.1.1 to the DB-IP database and Geolite2 City database:
The ask in this feature request is to add support for more databases, specifically my case would be the DB-IP Location + ISP database, but it seems others would like the rest of the paid MaxMind databases as well.
It looks like the GeoIP filter can read the file but it expects a different schema for the data and therefore fails out when trying to use the DB-IP database in the GeoIP filter with the database option.
DB-IP's database schema is available here:
https://db-ip.com/db/format/ip-to-location-isp/mmdb.html
They also link to a MaxMind code library to read MMDB's which when I attempted to read the DB-IP database it wanted to use the Enterprise database reader, which at the moment doesn't appear to be supported by the GeoIP Filter.
I don't have access to a MaxMind Enterprise database so I couldn't check if to see the schema is similar or not, but the library seems to think so.
Also, it looks like the GeoIP filter does not recognize that MaxMind has added additional databases, such as the Enterprise, Anonymous IP, Connection Type, and Domain, all of which are paid MaxMind databases. Info for these databases can be found here: https://dev.maxmind.com/
There have been a few pull requests for adding support for some of these databases to the GeoIP Filter:
Anonymous IP database PR from 2018: logstash-plugins/logstash-filter-geoip#141
Domain database PR from 2020: https://github.com/logstash-plugins/logstash-filter-geoip/pull/162
Finally, here is a sample of data that I was able to pull using MaxMind's Python MMDB file reader inputting the IP 1.1.1.1 to the DB-IP database and Geolite2 City database:
https://github.com/maxmind/MaxMind-DB-Reader-python
Geolit2 Database:
DB-IP Database:
Thank you
The text was updated successfully, but these errors were encountered: