Adding Geo data to monitored hosts

I have heartbeat running and sending correctly data to my ES.
I would like to add geo data to the hosts I monitor to show them on a Map
I know we can add geo data to the observer, but is there a way to add geo data to the monitored hosts ?
Thanks for any tips or example

Have a look here

I know this ingest processor
However, the heartbeat ecs has monitor.ip which is nower in this processor.
Should I create my own processor for heartbeat to cover the geo data of monitor.ip ?

Yes of course you can, the only thing is that monitor.ip shoud be a public IP

Yes, of course
Any tips on enriching internal IP of my organization ?

One option you have is to use an enrich policy
Load your internal IP & locations into an index

Great thanks
have a good WE

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.