Don't overwrite existing fields in GeoIP processor

[jderose9]

Please allow GeoIP processor to run without blowing away existing property values. This would be consistent with the logstash plugin which merges the objects. Perhaps a config setting to toggle overwrite/merge would be best.

I am trying to store all values in the appropriate ECS fields (for example, client.geo), and would like the client application to persist any of the geo data that it may have since it is likely more accurate.

[elasticmachine]

Pinging @elastic/es-core-features

[martijnvg]

Thanks for opening this issue @jderose9.

Perhaps a config setting to toggle overwrite/merge would be best.

Yes, I think so too. We properly need to default to overwrite in order to need break bwc and we can consider to default to merge in the next major version (8.0 and later). Perhaps merge_on_overwrite is a good name, as the some processors support overwrite setting that controls whether a field should overwritten if it already exists.