GEOIP Not working when enabled in SOC Manager

[Ncgodwod]

[dougburks]

@Ncgodwod I've converted this from an ISSUE to a DISCUSSION.

Please try the following and see if it helps:

sudo so-elasticsearch-query _cluster/settings -d '{"persistent":{"ingest.geoip.downloader.enabled":true}}' -XPUT

[dougburks]

Based on the screenshot, I'd recommend double-checking your network just to make sure you aren't running into any firewall or proxy issues. Then I'd look into the shards error.

[Ncgodwod]

Okay.. We are using an in house cert for SSL intercept.
From the documents it looks like I need to put it into the elasticsearch keystore?
I have tried to put it in /etc/ssl/certs in so-elasticsearch, and then run update-ca-certificates, but that doesnt work.

Would you recommend trying to add this to the keystore?

[Ncgodwod]

So. We know we need to add our org CA-cert to the elasticsearch cert store at /etc/ssl/certs/ca-certificates.crt in the so-elasticsearch container.

Running update-ca-certificates while root in the container did not work. So we made a salt sls file to add the cert, and get this error.

From what it looks like we need to add the cert to elastic's jvm truststore. We tried using the keytool command in so-elasticsearch with no luck.

[reyesj2]

I would probably recommend this https://www.elastic.co/guide/en/elasticsearch/reference/8.14/geoip-processor.html#manage-geoip-database-updates over messing with the elasticsearch trust.

Again don't recommend and I haven't tried this out with custom certs, but there is a script used to add the self signed SO cert to elasticsearch truststore so-catrust that you could use to guide you on adding an additional cert. If you must I would recommend backing up the trust prior to modifying.

[Ncgodwod]

Interesting.... Well, since updating to 2.4.120 it started working? We have no clue how/why.

[dougburks]

We include a static copy of the geoip databases which in theory should have been working before you updated. Perhaps something in the update process reverted Elasticsearch back to using that local copy. In any case, glad it's working now.