GEOIP Not working when enabled in SOC Manager

[Ncgodwod]

[dougburks]

@Ncgodwod I've converted this from an ISSUE to a DISCUSSION.

Please try the following and see if it helps:

sudo so-elasticsearch-query _cluster/settings -d '{"persistent":{"ingest.geoip.downloader.enabled":true}}' -XPUT

[Ncgodwod]

My netflow logs show the same "geoip_expired_database".
I also restarted so-elasticsearch as you can see.

[dougburks]

Have you verified that Elasticsearch has access to the following URLs from https://docs.securityonion.net/en/2.4/firewall.html#internet-communication?

geoip.elastic.co
storage.googleapis.com

Also note that the default GeoIP poll interval is 3 days:
https://www.elastic.co/guide/en/elasticsearch/reference/8.14/geoip-processor.html#geoip-cluster-settings

Have you checked the Elasticsearch log for additional clues to see if it has tried to update GeoIP data?

[Ncgodwod]

Wget/curl returns a 404 error, but it does look like these are accessible:
geoip.elastic.co
storage.googleapis.com

However...

[dougburks]

Based on the screenshot, I'd recommend double-checking your network just to make sure you aren't running into any firewall or proxy issues. Then I'd look into the shards error.