# 7.6.1 SIEM not showing packetbeat flow asn info

**URL:** <https://discuss.elastic.co/t/7-6-1-siem-not-showing-packetbeat-flow-asn-info/225293>\
**Category:** SIEM\
**Created:** [March 26, 2020, 9:07pm UTC](https://discuss.elastic.co/t/7-6-1-siem-not-showing-packetbeat-flow-asn-info/225293 "2020-03-26T21:07:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [March 26, 2020, 9:07pm UTC](https://discuss.elastic.co/t/7-6-1-siem-not-showing-packetbeat-flow-asn-info/225293/1 "2020-03-26T21:07:09Z")

</div>

Hello,

I was trying to enrich our flow data a bit from our Packetbeat data. Adding geoip data worked fine and showed up in SIEM, but I have some isues getting ASN info shown correctly in SIEM.

So I made this processor:

```
PUT _ingest/pipeline/geoip-info
{
  "description": "Add geoip info",
  "processors": [
    {
      "geoip": {
        "field": "client.ip",
        "target_field": "client.geo",
        "ignore_missing": true
      }
    },
    {
      "geoip": {
        "field": "client.ip",
        "target_field": "client.as",
        "database_file": "GeoLite2-ASN.mmdb",
        "ignore_missing": true
      }
    },
    {
      "geoip": {
        "field": "source.ip",
        "target_field": "source.geo",
        "ignore_missing": true
      }
    },
    {
      "geoip": {
        "field": "source.ip",
        "target_field": "source.as",
        "database_file": "GeoLite2-ASN.mmdb",
        "ignore_missing": true
      }
    },
    {
      "geoip": {
        "field": "destination.ip",
        "target_field": "destination.geo",
        "ignore_missing": true
      }
    },
    {
      "geoip": {
        "field": "destination.ip",
        "target_field": "destination.as",
        "database_file": "GeoLite2-ASN.mmdb",
        "ignore_missing": true
      }
    },
    {
      "geoip": {
        "field": "server.ip",
        "target_field": "server.geo",
        "ignore_missing": true
      }
    },
    {
      "geoip": {
        "field": "server.ip",
        "target_field": "server.as",
        "database_file": "GeoLite2-ASN.mmdb",
        "ignore_missing": true
      }
    }
  ]
}

```

And added ` pipeline: "geoip-info"` to the output in packetbeat.yml.

The as fields are added to the packetbeat data:

![image](https://us1.discourse-cdn.com/elastic/original/3X/9/5/9589f90c6ee1bdc371079857b3cf7c51303afce1.png)

But for some reason the ASN data is not shown in SIEM.

![image](https://us1.discourse-cdn.com/elastic/original/3X/c/9/c9dfc159a4bee905e46293f3dbd427085e04f481.png)

Not sure why, I did notice a difference and that there is also `as.organization.name` in the latest ECS versions. Maybe SIEM doesn't work with `as.organization_name`?

Grtz

Willem

---

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [March 26, 2020, 9:35pm UTC](https://discuss.elastic.co/t/7-6-1-siem-not-showing-packetbeat-flow-asn-info/225293/2 "2020-03-26T21:35:48Z")

</div>

Hello,

I can confirm that when I rename the organization\_name as field to organization.name, it works..

```
PUT _ingest/pipeline/geoip-info
{
  "description": "Add geoip info",
  "processors": [
    {
      "geoip": {
        "field": "client.ip",
        "target_field": "client.geo",
        "ignore_missing": true
      }
    },
    {
      "geoip": {
        "field": "client.ip",
        "target_field": "client.as",
        "database_file": "GeoLite2-ASN.mmdb",
        "ignore_missing": true
      }
    },
    {
      "rename": {
        "field": "client.as.organization_name",
        "target_field": "client.as.organization.name",
        "ignore_missing": true
      }
    },
    {
      "geoip": {
        "field": "source.ip",
        "target_field": "source.geo",
        "ignore_missing": true
      }
    },
    {
      "geoip": {
        "field": "source.ip",
        "target_field": "source.as",
        "database_file": "GeoLite2-ASN.mmdb",
        "ignore_missing": true
      }
    },
    {
      "rename": {
        "field": "source.as.organization_name",
        "target_field": "source.as.organization.name",
        "ignore_missing": true
      }
    },
    {
      "geoip": {
        "field": "destination.ip",
        "target_field": "destination.geo",
        "ignore_missing": true
      }
    },
    {
      "geoip": {
        "field": "destination.ip",
        "target_field": "organization_name",
        "database_file": "GeoLite2-ASN.mmdb",
        "ignore_missing": true
      }
    },
    {
      "rename": {
        "field": "destination.as.organization_name",
        "target_field": "destination.as.organization.name",
        "ignore_missing": true
      }
    },
    {
      "geoip": {
        "field": "server.ip",
        "target_field": "server.geo",
        "ignore_missing": true
      }
    },
    {
      "geoip": {
        "field": "server.ip",
        "target_field": "server.as",
        "database_file": "GeoLite2-ASN.mmdb",
        "ignore_missing": true
      }
    },
    {
      "rename": {
        "field": "server.as.organization_name",
        "target_field": "server.as.organization.name",
        "ignore_missing": true
      }
    }
  ]
}

```

This seems to imply that the geoip ingest processor needs to be updated? Having to rename those fields is not very optimal. Also the documentation doesn't mention this anywhere.

Grtz

Willem

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 23, 2020, 9:35pm UTC](https://discuss.elastic.co/t/7-6-1-siem-not-showing-packetbeat-flow-asn-info/225293/3 "2020-04-23T21:35:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.