elastic / elastic/integrations

[Azure Logs]: geo.country_name field is replaced by location.state , which does not apply for every country

Open
#13,447 1 comment 0 reactions 0 assignees View on GitHub
Integration:azure needs:triage Team:obs-ds-hosted-services
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 17h
Merged PRs (30d)
225

Description

### Integration Name

Azure Logs [azure]

### Dataset Name

azure.signin

### Integration Version

1.23.0

### Agent Version

8.17

### Agent Output Type

elasticsearch

### Elasticsearch Version

8.17

### OS Version and Architecture

n/a

### Software/API Version

_No response_

### Error Message

The way the ingest pipeline is configured, we override the `geo.country_name` field with the `location.state` value, which is incorrect for most countries:

https://github.com/elastic/integrations/blob/main/packages/azure/data_stream/signinlogs/elasticsearch/ingest_pipeline/default.yml#L177-L180

For instance the example provided is wrong for France:

https://github.com/elastic/integrations/blob/main/packages/azure/data_stream/signinlogs/sample_event.json#L74-L82

This seems to be the default since the pipeline was created:

https://github.com/elastic/integrations/blob/d7c49618bc21749d67c04d4d058f929a1e5fb696/packages/azure/data_stream/signinlogs/elasticsearch/ingest_pipeline/default.yml#L225-L228

But I don't see the rationale or context behind it.

Is this a limitation caused by the data we get from Azure?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.