Skip to content
This repository has been archived by the owner on Apr 16, 2021. It is now read-only.

securityonion-elastic: check ingest geoip fields #1725

Closed
dougburks opened this issue Feb 21, 2020 · 2 comments
Closed

securityonion-elastic: check ingest geoip fields #1725

dougburks opened this issue Feb 21, 2020 · 2 comments
Assignees
@dougburks
Projects
16.04.6.5

Comments

@dougburks
Copy link
Contributor

dougburks commented Feb 21, 2020 •
edited

Looks like we might still be getting an extra geoip field from elasticsearch ingest node parsing: region_iso_code.

image

We do have a region_code field in our template, so if this is the same field, it may just need to be renamed.

https://www.elastic.co/guide/en/logstash/7.x/plugins-filters-geoip.html
@dougburks dougburks added this to To do in 16.04.6.5 via automation Feb 21, 2020
dougburks added a commit to Security-Onion-Solutions/securityonion-elastic that referenced this issue Mar 6, 2020
@dougburks
securityonion-elastic: check ingest geoip fields Security-Onion-Solut…
2ca3b48 
…ions/security-onion#1725
@dougburks dougburks moved this from To do to In progress in 16.04.6.5 Mar 6, 2020
@dougburks dougburks moved this from In progress to In Testing in 16.04.6.5 Mar 6, 2020
@dougburks dougburks self-assigned this Mar 9, 2020
@dougburks
Copy link
Contributor Author

To test, please verify that Elasticsearch ingest node parsing now renames region_iso_code to region_code.

@dougburks dougburks moved this from In Testing to Tested in 16.04.6.5 Mar 18, 2020
@dougburks
Copy link
Contributor Author

Published:
https://blog.securityonion.net/2020/03/elastic-687-now-available-for-security.html

16.04.6.5 automation moved this from Tested to Done Mar 18, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@dougburks dougburks

Labels
None yet
Projects
No open projects
16.04.6.5
  
Done
Milestone
No milestone
Development

No branches or pull requests
1 participant
@dougburks