Add support for GeoIP2-ISP database

[ejectck]

As written in comment to geoip.rb "The path to the GeoLite2 database file which Logstash should use. Only City database is supported by now".

As for support Legacy database dropped in geoip, for me there is no way to get information from GeoIPASNum.dat (legacy) or GeoIP2-ISP.mmdb (new format) databases to get information about ASNum by IP.

Dropping support for Legacy and not adding support for new database is quite big problem for me.

[imriz]

Hi,

I encountered this today too.
I've patched the plugin to allow you to use the ISP database.
See PR #94

I am currently using it as:

    geoip {
      source => "client_ip"
    }
    geoip {
      source => "client_ip"
      dbtype => "isp"
      merge => true
      database => "/etc/maxmind/GeoIP2-ISP.mmdb"
    }

[IngaFeick]

+1

[briangruber]

+1

[tomsommer]

ISP support is documented but not implemented?
https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html#plugins-filters-geoip-database

+1

[sh4t]

They do have ISP-ASN database as .mmdb; just not available publicly to my knowledge. It is available in the legacy format, and .mmdb format to paying subscribers.

[SMAPPER]

Any idea of if/when this may be put into general availability?

[jordansissel]

@SMAPPER please try to not comment on the same issue in multiple places at the same time (reference: #96 (comment) and #91 (comment)).

If you want updates on this issue, I recommend watching this issue in Github:

[acchen97]

An update for those encountering this: we now have a plan for resolving ISP and ASN lookups. Feel free to provide additional feedback on this issue #110.

[acchen97]

Closing as this has been delivered with geoip filter v4.1.0.