什么是 geoip 处理器？

简而言之，一种将 IP 地址转换为地理位置数据的处理器。请参阅我之前的文章 “Elasticsearch：运用 geoip 处理器来丰富数据”。举个例子，你有一个 IP 地址“8.8.8.8”，应该按如下方式解析：



1.  PUT _ingest/pipeline/geoip
2.  {
3.    "description" : "Add geoip info",
4.    "processors" : [
5.      {
6.        "geoip" : {
7.          "field" : "ip"
8.        }
9.      }
10.    ]
11.  }

13.  PUT my_index/_doc/my_id?pipeline=geoip
14.  {
15.    "ip": "8.8.8.8"
16.  }

18.  GET my_index/_doc/my_id

上面最后一个命令返回的结果是：



1.  {
2.    "_index" : "my_index",
3.    "_type" : "_doc",
4.    "_id" : "my_id",
5.    "_version" : 4,
6.    "_seq_no" : 5,
7.    "_primary_term" : 9,
8.    "found" : true,
9.    "_source" : {
10.      "geoip" : {
11.        "continent_name" : "North America",
12.        "country_iso_code" : "US",
13.        "location" : {
14.          "lon" : -97.822,
15.          "lat" : 37.751
16.        }
17.      },
18.      "ip" : "8.8.8.8"
19.    }
20.  }

当你期望用于图表绘制的经纬度对（Kibana 地图可视化）或者你只是想知道此请求的来源（例如本例中的美国）时，地理位置将很有用。

一个奇怪的例外

对于大多数情况，Elasticsearch 发行版应该有可用的支持 geolite2 数据库文件。然而，有时你可能会发现你的发行版未能使用这些文件。例外情况是这样的句子“_geoip_database_unavailable_GeoLite2-City.mmdb”。显然缺少一个 geolite2 数据库文件。

要进一步证明 geolite2 文件是否可用，请运行以下命令：

![图片转存失败，建议将图片保存下来直接上传
        `

1.  POST _ingest/pipeline/_simulate
2.  {
3.    "pipeline": {
4.      "processors": [
5.        {
6.          "geoip": {
7.            "field": "location"
8.          }
9.        }
10.      ]
11.    },
12.    "docs": [
13.      {
14.        "_source": {
15.          "location": "8.8.8.8"
16.        }
17.      }
18.    ]
19.  }

` (https://csdnimg.cn/release/blogv2/dist/pc/img/newCodeMoreWhite.png)
]()```

在我的电脑上显示如下的响应：

![](https://p3-juejin.byteimg.com/tos-cn-i-k3u1fbpfcp/657fe8397b2e47bc8f6796b3fd89d51a~tplv-k3u1fbpfcp-zoom-1.image)

如果你遇到 “_geoip_database_unavailable_GeoLite2-City.mmdb” 异常，恭喜……你是幸运儿。 你找对地方了 [Smile]。

解决方案
====

运行以下测试并检查数据库文件是否存在：

check the database file availability
GET _ingest/geoip/stats


在我的电脑上显示：

{
"stats": {
```
 "successful_downloads": 0,
```
```
 "failed_downloads": 1,
```
```
 "total_download_time": 0,
```
```
 "databases_count": 0,
```
```
 "skipped_updates": 0,
```
```
 "expired_databases": 3
```
},
"nodes": {}
}


如果你看到结果显示一个空节点（nodes）……那么可能由于某些原因预期的文件不可用。

接下来运行以下命令以启用 Elasticsearch 以再次下载和管理数据库文件

PUT _cluster/settings
{
"persistent": {
```
 "ingest": {
```
```
   "geoip": {
```
```
     "downloader": {
```
```
       "enabled": "true"
```
```
     }
```
```
   }
```
```
 }
```
}
}


上述命令显示相应：

{
"acknowledged": true,
"persistent": {
```
 "ingest": {
```
```
   "geoip": {
```
```
     "downloader": {
```
```
       "enabled": "true"
```
```
     }
```
```
   }
```
```
 }
```
},
"transient": {}
}


等过一会儿，我执行如下的命令：

POST _ingest/pipeline/_simulate
{
"pipeline": {
```
 "processors": [
```
```
   {
```
```
     "geoip": {
```
```
       "field": "location"
```
```
     }
```
```
   }
```
```
 ]
```
},
"docs": [
```
 {
```
```
   "_source": {
```
```
     "location": "8.8.8.8"
```
```
   }
```
```
 }
```
]
}


上面命令显示的结果是：

{
"docs": [
```
 {
```
```
   "doc": {
```
```
     "_index": "_index",
```
```
     "_id": "_id",
```
```
     "_version": "-3",
```
```
     "_source": {
```
```
       "location": "8.8.8.8",
```
```
       "geoip": {
```

         "continent_name": "North America",

```
         "region_iso_code": "US-CA",
```
```
         "city_name": "Los Angeles",
```
```
         "country_iso_code": "US",
```

         "country_name": "United States",

```
         "region_name": "California",
```
```
         "location": {
```
```
           "lon": -118.2441,
```
```
           "lat": 34.0544
```
```
         }
```
```
       }
```
```
     },
```
```
     "_ingest": {
```

       "timestamp": "2023-03-01T23:22:39.676904Z"

```
     }
```
```
   }
```
```
 }
```
]
}


如果我们再次执行如下的命令：

GET _ingest/geoip/stats


我们会发现：

{
"stats": {
```
 "successful_downloads": 0,
```
```
 "failed_downloads": 1,
```
```
 "total_download_time": 0,
```
```
 "databases_count": 0,
```
```
 "skipped_updates": 0,
```
```
 "expired_databases": 0
```
},
"nodes": {
```
 "o75KS8A4ReKg36ILS1BK1A": {
```
```
   "databases": [
```
```
     {
```
```
       "name": "GeoLite2-ASN.mmdb"
```
```
     },
```
```
     {
```
```
       "name": "GeoLite2-Country.mmdb"
```
```
     },
```
```
     {
```
```
       "name": "GeoLite2-City.mmdb"
```
```
     }
```
```
   ],
```
```
   "files_in_temp": [
```

     "GeoLite2-ASN.mmdb_elastic-geoip-database-service-agreement-LICENSE.txt",

```
     "GeoLite2-ASN.mmdb_LICENSE.txt",
```
```
     "GeoLite2-City.mmdb_LICENSE.txt",
```

     "GeoLite2-Country.mmdb_elastic-geoip-database-service-agreement-LICENSE.txt",

```
     "GeoLite2-ASN.mmdb",
```

     "GeoLite2-City.mmdb_COPYRIGHT.txt",

```
     "GeoLite2-City.mmdb",
```

     "GeoLite2-City.mmdb_elastic-geoip-database-service-agreement-LICENSE.txt",

     "GeoLite2-Country.mmdb_LICENSE.txt",

```
     "GeoLite2-Country.mmdb",
```

     "GeoLite2-ASN.mmdb_COPYRIGHT.txt",

     "GeoLite2-Country.mmdb_COPYRIGHT.txt",

```
     "GeoLite2-City.mmdb_README.txt"
```
```
   ]
```
```
 }
```
}
}


这次，我们可以看到 nodes 里的数据是有数据的。

Elasticsearch：如何解决 Elasticsearch Geoip 处理器故障

什么是 geoip 处理器？

一个奇怪的例外

check the database file availability