Add property to GeoIp processor continent_code
.
#85820
Labels
:Data Management/Ingest Node
Execution or management of Ingest Pipelines including GeoIP
>enhancement
Team:Data Management
Meta label for data/management team
Description
Hi, I'm currently using in my environment for ingestion filebeat>logstash>Elasticsearch, in order to reduce the resources we are going to take out Logstash and start using Filebeat instead directly to ingest the data to Elasticsearch.
I'm using the field
continent_code
and made several dashboards since Logstash allows it, check https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html, but checking the documentation to use an Elasticsearch processor there is nocontinent_code
field, check https://www.elastic.co/guide/en/elasticsearch/reference/current/geoip-processor.html, butcontinent_name
which I'm are not using in the template nor in the already ingested alerts.Asking in the community channel I couldn't find any alternatives and one user suggested opening a feature request https://elasticstack.slack.com/archives/CNEDGGJQ3/p1649742148197329
The alternative would be to rename the field property in the template or delete it, but in any case, I will have to reindex all the data to adapt to the new fields and modify the dashboards that currently are using
continent_code
, and change tocontinent_name
which is a tough task when several environments are involved with this kind of dashboards.I would be appreciated, if possible, having this feature as soon as you can add it if you decide to.
Thanks in advance.
The text was updated successfully, but these errors were encountered: