elastic / elastic/docs-content

[Community]: GeoIP missing SET geo.location processor

Open
#1,474 0 comments 0 reactions 0 assignees View on GitHub
community Team:Ingest
Dominant language
No language data
Stars
47
Forks
261
Avg merge
3d 21h
Merged PRs (30d)
141

Description

### What documentation page is affected

The GeoIP processor link misses the SET processor which is necessary for custom datasets. Without this users are left with 2 distinct fields (*.lat & *.lon).

[GeoIP Processor](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-geoip)

### What change would you like to see?

Add a set processor so folks will know how to apply, and a link to the mapping necessary for the field: [geo-point mapping](https://www.elastic.co/docs/reference/elasticsearch/mapping-reference/geo-point)

`{
"geoip": {
"ignore_failure": true,
"field": "threat.indicator.ip",
"target_field": "threat.indicator.geo"
}
},
{
"set": {
"ignore_failure": true,
"field": "threat.indicator.geo.location",
"value": "{{threat.indicator.geo.location.lat}}, {{threat.indicator.geo.location.lon}}"
}
}`

### Additional info

_No response_

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.