elasticstack.getElasticsearchIngestProcessorGeoip

Explore with Pulumi AI

elasticstack 0.11.15 published on Wednesday, Apr 23, 2025 by elastic

By default, the processor uses the GeoLite2 City, GeoLite2 Country, and GeoLite2 ASN GeoIP2 databases from MaxMind, shared under the CC BY-SA 4.0 license. Elasticsearch automatically downloads updates for these databases from the Elastic GeoIP endpoint: https://geoip.elastic.co/v1/database. To get download statistics for these updates, use the GeoIP stats API.

If your cluster can’t connect to the Elastic GeoIP endpoint or you want to manage your own updates, see Manage your own GeoIP2 database updates.

If Elasticsearch can’t connect to the endpoint for 30 days all updated databases will become invalid. Elasticsearch will stop enriching documents with geoip data and will add tags: ["_geoip_expired_database"] field instead.

See: https://www.elastic.co/guide/en/elasticsearch/reference/current/geoip-processor.html

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as elasticstack from "@pulumi/elasticstack";

const geoip = elasticstack.getElasticsearchIngestProcessorGeoip({
    field: "ip",
});
const myIngestPipeline = new elasticstack.ElasticsearchIngestPipeline("myIngestPipeline", {processors: [geoip.then(geoip => geoip.json)]});

import pulumi
import pulumi_elasticstack as elasticstack

geoip = elasticstack.get_elasticsearch_ingest_processor_geoip(field="ip")
my_ingest_pipeline = elasticstack.ElasticsearchIngestPipeline("myIngestPipeline", processors=[geoip.json])

package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/elasticstack/elasticstack"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		geoip, err := elasticstack.GetElasticsearchIngestProcessorGeoip(ctx, &elasticstack.GetElasticsearchIngestProcessorGeoipArgs{
			Field: "ip",
		}, nil)
		if err != nil {
			return err
		}
		_, err = elasticstack.NewElasticsearchIngestPipeline(ctx, "myIngestPipeline", &elasticstack.ElasticsearchIngestPipelineArgs{
			Processors: pulumi.StringArray{
				pulumi.String(geoip.Json),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Elasticstack = Pulumi.Elasticstack;

return await Deployment.RunAsync(() => 
{
    var geoip = Elasticstack.GetElasticsearchIngestProcessorGeoip.Invoke(new()
    {
        Field = "ip",
    });

    var myIngestPipeline = new Elasticstack.ElasticsearchIngestPipeline("myIngestPipeline", new()
    {
        Processors = new[]
        {
            geoip.Apply(getElasticsearchIngestProcessorGeoipResult => getElasticsearchIngestProcessorGeoipResult.Json),
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.elasticstack.ElasticstackFunctions;
import com.pulumi.elasticstack.inputs.GetElasticsearchIngestProcessorGeoipArgs;
import com.pulumi.elasticstack.ElasticsearchIngestPipeline;
import com.pulumi.elasticstack.ElasticsearchIngestPipelineArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var geoip = ElasticstackFunctions.getElasticsearchIngestProcessorGeoip(GetElasticsearchIngestProcessorGeoipArgs.builder()
            .field("ip")
            .build());

        var myIngestPipeline = new ElasticsearchIngestPipeline("myIngestPipeline", ElasticsearchIngestPipelineArgs.builder()
            .processors(geoip.applyValue(getElasticsearchIngestProcessorGeoipResult -> getElasticsearchIngestProcessorGeoipResult.json()))
            .build());

    }
}

resources:
  myIngestPipeline:
    type: elasticstack:ElasticsearchIngestPipeline
    properties:
      processors:
        - ${geoip.json}
variables:
  geoip:
    fn::invoke:
      function: elasticstack:getElasticsearchIngestProcessorGeoip
      arguments:
        field: ip

Using getElasticsearchIngestProcessorGeoip

Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

function getElasticsearchIngestProcessorGeoip(args: GetElasticsearchIngestProcessorGeoipArgs, opts?: InvokeOptions): Promise<GetElasticsearchIngestProcessorGeoipResult>
function getElasticsearchIngestProcessorGeoipOutput(args: GetElasticsearchIngestProcessorGeoipOutputArgs, opts?: InvokeOptions): Output<GetElasticsearchIngestProcessorGeoipResult>

def get_elasticsearch_ingest_processor_geoip(database_file: Optional[str] = None,
                                             field: Optional[str] = None,
                                             first_only: Optional[bool] = None,
                                             ignore_missing: Optional[bool] = None,
                                             properties: Optional[Sequence[str]] = None,
                                             target_field: Optional[str] = None,
                                             opts: Optional[InvokeOptions] = None) -> GetElasticsearchIngestProcessorGeoipResult
def get_elasticsearch_ingest_processor_geoip_output(database_file: Optional[pulumi.Input[str]] = None,
                                             field: Optional[pulumi.Input[str]] = None,
                                             first_only: Optional[pulumi.Input[bool]] = None,
                                             ignore_missing: Optional[pulumi.Input[bool]] = None,
                                             properties: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                                             target_field: Optional[pulumi.Input[str]] = None,
                                             opts: Optional[InvokeOptions] = None) -> Output[GetElasticsearchIngestProcessorGeoipResult]

func GetElasticsearchIngestProcessorGeoip(ctx *Context, args *GetElasticsearchIngestProcessorGeoipArgs, opts ...InvokeOption) (*GetElasticsearchIngestProcessorGeoipResult, error)
func GetElasticsearchIngestProcessorGeoipOutput(ctx *Context, args *GetElasticsearchIngestProcessorGeoipOutputArgs, opts ...InvokeOption) GetElasticsearchIngestProcessorGeoipResultOutput

> Note: This function is named GetElasticsearchIngestProcessorGeoip in the Go SDK.

public static class GetElasticsearchIngestProcessorGeoip 
{
    public static Task<GetElasticsearchIngestProcessorGeoipResult> InvokeAsync(GetElasticsearchIngestProcessorGeoipArgs args, InvokeOptions? opts = null)
    public static Output<GetElasticsearchIngestProcessorGeoipResult> Invoke(GetElasticsearchIngestProcessorGeoipInvokeArgs args, InvokeOptions? opts = null)
}

public static CompletableFuture<GetElasticsearchIngestProcessorGeoipResult> getElasticsearchIngestProcessorGeoip(GetElasticsearchIngestProcessorGeoipArgs args, InvokeOptions options)
public static Output<GetElasticsearchIngestProcessorGeoipResult> getElasticsearchIngestProcessorGeoip(GetElasticsearchIngestProcessorGeoipArgs args, InvokeOptions options)

fn::invoke:
  function: elasticstack:index/getElasticsearchIngestProcessorGeoip:getElasticsearchIngestProcessorGeoip
  arguments:
    # arguments dictionary

The following arguments are supported:

Field string: The field to get the ip address from for the geographical lookup.
DatabaseFile string: The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
FirstOnly bool: If true only first found geoip data will be returned, even if field contains array.
IgnoreMissing bool: If true and field does not exist, the processor quietly exits without modifying the document.
Properties List<string>: Controls what properties are added to the target_field based on the geoip lookup.
TargetField string: The field that will hold the geographical information looked up from the MaxMind database.

Field string: The field to get the ip address from for the geographical lookup.
DatabaseFile string: The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
FirstOnly bool: If true only first found geoip data will be returned, even if field contains array.
IgnoreMissing bool: If true and field does not exist, the processor quietly exits without modifying the document.
Properties []string: Controls what properties are added to the target_field based on the geoip lookup.
TargetField string: The field that will hold the geographical information looked up from the MaxMind database.

field String: The field to get the ip address from for the geographical lookup.
databaseFile String: The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
firstOnly Boolean: If true only first found geoip data will be returned, even if field contains array.
ignoreMissing Boolean: If true and field does not exist, the processor quietly exits without modifying the document.
properties List<String>: Controls what properties are added to the target_field based on the geoip lookup.
targetField String: The field that will hold the geographical information looked up from the MaxMind database.

field string: The field to get the ip address from for the geographical lookup.
databaseFile string: The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
firstOnly boolean: If true only first found geoip data will be returned, even if field contains array.
ignoreMissing boolean: If true and field does not exist, the processor quietly exits without modifying the document.
properties string[]: Controls what properties are added to the target_field based on the geoip lookup.
targetField string: The field that will hold the geographical information looked up from the MaxMind database.

field str: The field to get the ip address from for the geographical lookup.
database_file str: The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
first_only bool: If true only first found geoip data will be returned, even if field contains array.
ignore_missing bool: If true and field does not exist, the processor quietly exits without modifying the document.
properties Sequence[str]: Controls what properties are added to the target_field based on the geoip lookup.
target_field str: The field that will hold the geographical information looked up from the MaxMind database.

field String: The field to get the ip address from for the geographical lookup.
databaseFile String: The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
firstOnly Boolean: If true only first found geoip data will be returned, even if field contains array.
ignoreMissing Boolean: If true and field does not exist, the processor quietly exits without modifying the document.
properties List<String>: Controls what properties are added to the target_field based on the geoip lookup.
targetField String: The field that will hold the geographical information looked up from the MaxMind database.

getElasticsearchIngestProcessorGeoip Result

The following output properties are available:

Field string: The field to get the ip address from for the geographical lookup.
Id string: Internal identifier of the resource
Json string: JSON representation of this data source.
DatabaseFile string: The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
FirstOnly bool: If true only first found geoip data will be returned, even if field contains array.
IgnoreMissing bool: If true and field does not exist, the processor quietly exits without modifying the document.
Properties List<string>: Controls what properties are added to the target_field based on the geoip lookup.
TargetField string: The field that will hold the geographical information looked up from the MaxMind database.

Field string: The field to get the ip address from for the geographical lookup.
Id string: Internal identifier of the resource
Json string: JSON representation of this data source.
DatabaseFile string: The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
FirstOnly bool: If true only first found geoip data will be returned, even if field contains array.
IgnoreMissing bool: If true and field does not exist, the processor quietly exits without modifying the document.
Properties []string: Controls what properties are added to the target_field based on the geoip lookup.
TargetField string: The field that will hold the geographical information looked up from the MaxMind database.

field String: The field to get the ip address from for the geographical lookup.
id String: Internal identifier of the resource
json String: JSON representation of this data source.
databaseFile String: The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
firstOnly Boolean: If true only first found geoip data will be returned, even if field contains array.
ignoreMissing Boolean: If true and field does not exist, the processor quietly exits without modifying the document.
properties List<String>: Controls what properties are added to the target_field based on the geoip lookup.
targetField String: The field that will hold the geographical information looked up from the MaxMind database.

field string: The field to get the ip address from for the geographical lookup.
id string: Internal identifier of the resource
json string: JSON representation of this data source.
databaseFile string: The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
firstOnly boolean: If true only first found geoip data will be returned, even if field contains array.
ignoreMissing boolean: If true and field does not exist, the processor quietly exits without modifying the document.
properties string[]: Controls what properties are added to the target_field based on the geoip lookup.
targetField string: The field that will hold the geographical information looked up from the MaxMind database.

field str: The field to get the ip address from for the geographical lookup.
id str: Internal identifier of the resource
json str: JSON representation of this data source.
database_file str: The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
first_only bool: If true only first found geoip data will be returned, even if field contains array.
ignore_missing bool: If true and field does not exist, the processor quietly exits without modifying the document.
properties Sequence[str]: Controls what properties are added to the target_field based on the geoip lookup.
target_field str: The field that will hold the geographical information looked up from the MaxMind database.

field String: The field to get the ip address from for the geographical lookup.
id String: Internal identifier of the resource
json String: JSON representation of this data source.
databaseFile String: The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
firstOnly Boolean: If true only first found geoip data will be returned, even if field contains array.
ignoreMissing Boolean: If true and field does not exist, the processor quietly exits without modifying the document.
properties List<String>: Controls what properties are added to the target_field based on the geoip lookup.
targetField String: The field that will hold the geographical information looked up from the MaxMind database.

Package Details

Repository: elasticstack elastic/terraform-provider-elasticstack
License
Notes: This Pulumi package is based on the elasticstack Terraform Provider.

elasticstack 0.11.15 published on Wednesday, Apr 23, 2025 by elastic

elastic/terraform-provider-elasticstack

elasticstack.getElasticsearchIngestProcessorGeoip

On this page

On this page

Example Usage

Using getElasticsearchIngestProcessorGeoip

getElasticsearchIngestProcessorGeoip Result

Package Details

On this page

On this page