🚨 Logstash Error: 'The MaxMind database has been expired' — Cause, Fix, and Troubleshooting Guide

Overview

Since Logstash 7.14 the geoip filter no longer ships a static database file. Instead a built-in database manager downloads the GeoLite2 databases from an Elastic-hosted endpoint at startup and refreshes them periodically over the internet. This keeps IP-to-location data current without manual updates — as long as the host can reach that endpoint. If it cannot for roughly 30 days, the local copy is considered stale, the manager blocks it, and the filter stops enriching events. The error in /var/log/logstash/logstash-plain.log reads:

[ERROR][logstash.filters.geoip.databasemanager][main] The MaxMind database has been expired. Logstash is unable to get newer version from internet. Please check the network settings and allow Logstash accesses the internet to download the latest database, or configure Logstash to use a self-managed database.

The manager deliberately refuses to serve an expired database rather than silently returning stale locations. On air-gapped or egress-restricted hosts this is common: the initial download may have succeeded during provisioning, but with no ongoing internet access the 30-day clock eventually runs out and geoip enrichment goes dark.

Symptoms

• Recurring The MaxMind database has been expired errors from logstash.filters.geoip.databasemanager.
• Events stop gaining [geoip] fields (geoip.city_name, geoip.location, geoip.country_iso_code) — maps and geo dashboards in Kibana go empty.
• The problem appears about a month after deployment on a host with no outbound internet access, or right after a firewall/proxy change cut egress to the update endpoint.
• Logs may also show earlier unable to get newer version warnings in the weeks before the hard expiry.
• No pipeline crash — ingestion continues, only the geo enrichment is missing.

Common Root Causes

• No egress to the Elastic GeoIP update endpoint — an air-gapped or firewalled host cannot reach the internet to refresh the database, so it expires after ~30 days.
• Proxy not configured — the host has internet only via an HTTP(S) proxy that Logstash was never told about.
• DNS or TLS interception failure — the update request is blocked or broken by a corporate middlebox, so refresh silently fails until expiry.
• Auto-downloader left enabled on a self-managed host — an operator dropped in their own .mmdb but never disabled the downloader, so the manager still expects to refresh and expires the file it is managing.
• Clock skew — a badly wrong system clock can make a freshly downloaded database appear expired.

How to diagnose

Confirm the host can actually reach the update endpoint. Enrichment depends entirely on outbound connectivity from the Logstash host:

# Can the host resolve and reach the internet at all?
getent hosts geoip.elastic.co
curl -s -o /dev/null -w '%{http_code}\n' https://geoip.elastic.co/v1/database

# If a proxy is required, is it set for the service?
systemctl show logstash -p Environment | tr ' ' '\n' | grep -Ei 'http_proxy|https_proxy'

Inspect where Logstash stores the managed databases and how old they are:

ls -l /usr/share/logstash/data/geoip_database_management/
find /usr/share/logstash/data/geoip_database_management/ -name '*.mmdb' -mtime +25

Check the current geoip filter to see whether it relies on the auto-managed database or names its own. Pipeline .conf files use a Ruby-like DSL:

filter {
  geoip {
    source => "client_ip"
    target => "geoip"
    # no `database =>` means the auto-downloader is in charge
  }
}

Confirm the clock is sane, since skew can fake an expiry:

timedatectl status | grep -E 'System clock|NTP'

Fixes

You have two clean options: restore internet access, or self-manage the database. Restoring egress is the smaller change — allow the Logstash host outbound HTTPS to the GeoIP update endpoint (or point it at your proxy), then restart and watch the manager fetch a fresh copy:

sudo systemctl restart logstash
sudo tail -f /var/log/logstash/logstash-plain.log | grep -i geoip

On air-gapped hosts, self-manage instead. Create a MaxMind account, download GeoLite2-City.mmdb, place it on the host readable by the logstash user, and point the filter at it explicitly:

filter {
  geoip {
    source   => "client_ip"
    target   => "geoip"
    database => "/etc/logstash/geoip/GeoLite2-City.mmdb"
  }
}

Then disable the auto-downloader in /etc/logstash/logstash.yml so the manager stops expecting an internet refresh and stops expiring the file you now own:

xpack.geoip.downloader.enabled: false

Because a self-managed database does not auto-update, refresh it yourself on a schedule. A simple cron that pulls the latest MaxMind copy and reloads keeps it current:

# /etc/cron.d/geoip-refresh — weekly refresh of the self-managed DB
0 3 * * 0 logstash /etc/logstash/geoip/refresh-geolite.sh

What to watch out for

• Self-managed databases go stale silently — there is no expiry error to warn you, so you must schedule refreshes or your geo data quietly drifts out of date.
• MaxMind’s GeoLite2 requires accepting their license and using an account/license key; scraping the file without one will break when they rotate download URLs.
• Keep the .mmdb readable by the logstash service user and outside the config directory so a config redeploy never deletes it.
• Do not leave xpack.geoip.downloader.enabled: true while also setting database => on an air-gapped host — the manager will keep trying to refresh and can re-trigger the expiry error. Pick one model.
• Alert on the has been expired log pattern so a lapsed database is caught within days, not after a month of missing geo fields.

Related

• _grokparsefailure tag on parsed events
• translate filter dictionary not found
• Invalid field reference