Add geoip on existing index

Elastic Stack Elasticsearch
3

Awesome, thanks a lot!

In case someone is interested by this, here are the steps to make it working

  • Install the ingest-geoip processor (sudo bin/elasticsearch-plugin install ingest-geoip)
  • Create your pipeline (some document may not have the ip so I've tuned it so that it doesn't stop if one document doesn't have it). The IP is stored in requestIpv4 in my document:
PUT _ingest/pipeline/geoip
{
  "description" : "Add geoip info",
  "processors" : [
    {
      "geoip" : {
        "field" : "requestIpv4",
        "ignore_missing" : true
      }
    }
  ]
}
  • Create a new index that is similar to the index you want to migrate (for instance foo-geo for your existing foo index) with an additional property in your mapping 
"geoip": {
    "type": "object",
    "dynamic": true,
    "properties": {
        "location": {
            "type": "geo_point"
        }
    }
}
  • Reindex your foo index to foo-geo, adding the geolocation information:
POST _reindex
{
  "source": {
    "index": "foo"
  },
  "dest": {
    "index": "foo-geo",
    "pipeline": "geoip"
  }
}

I guess the next step is to create the mapping on foo and move foo-geo to foo again. I haven't found an easier way to rename the index.

2 Likes