Elasticsearch geiop issue

[palichx]

Hi!
After upgrade to 2.3.140 there is no Geoip databases in docker container on my searh node.

Now each seach node download geoip database from internet?

[dougburks]

We noticed this recently as well. This appears to be a change from Elastic 7 to Elastic 8. If you can allow your search nodes to access https://geoip.elastic.co/v1/database, then you may be able to make this work again.

From https://www.elastic.co/guide/en/elasticsearch/reference/current/geoip-processor.html:

By default, the processor uses the GeoLite2 City, GeoLite2 Country, and GeoLite2 ASN GeoIP2 databases from MaxMind, shared under the CC BY-SA 4.0 license. Elasticsearch automatically downloads updates for these databases from the Elastic GeoIP endpoint: https://geoip.elastic.co/v1/database.

[dougburks]

We've updated our documentation:
https://docs.securityonion.net/en/2.3/firewall.html#internet-communication
https://docs.securityonion.net/en/2.3/elasticsearch.html#geoip
https://docs.securityonion.net/en/2.3/soup.html#elastic-8

We've also created the following issues:
#8370
#8373