elastic / elastic/integrations
[Azure Logs]: geo.country_name field is replaced by location.state , which does not apply for every country
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 225
Description
### Integration Name
Azure Logs [azure]
### Dataset Name
azure.signin
### Integration Version
1.23.0
### Agent Version
8.17
### Agent Output Type
elasticsearch
### Elasticsearch Version
8.17
### OS Version and Architecture
n/a
### Software/API Version
_No response_
### Error Message
The way the ingest pipeline is configured, we override the `geo.country_name` field with the `location.state` value, which is incorrect for most countries:
https://github.com/elastic/integrations/blob/main/packages/azure/data_stream/signinlogs/elasticsearch/ingest_pipeline/default.yml#L177-L180
For instance the example provided is wrong for France:
https://github.com/elastic/integrations/blob/main/packages/azure/data_stream/signinlogs/sample_event.json#L74-L82
This seems to be the default since the pipeline was created:
https://github.com/elastic/integrations/blob/d7c49618bc21749d67c04d4d058f929a1e5fb696/packages/azure/data_stream/signinlogs/elasticsearch/ingest_pipeline/default.yml#L225-L228
But I don't see the rationale or context behind it.
Is this a limitation caused by the data we get from Azure?
Contributor guide
Assessment
This issue has not been assessed yet.