# Autonomous System Number (ASN) not displaying

**URL:** <https://discuss.elastic.co/t/autonomous-system-number-asn-not-displaying/206195>\
**Category:** SIEM\
**Created:** [November 1, 2019, 4:53pm UTC](https://discuss.elastic.co/t/autonomous-system-number-asn-not-displaying/206195 "2019-11-01T16:53:27Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Justin\_Doles](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/justin_doles/32/40730_2.png) [@Justin\_Doles](https://discuss.elastic.co/u/Justin_Doles)\
**Post date:** [November 1, 2019, 4:53pm UTC](https://discuss.elastic.co/t/autonomous-system-number-asn-not-displaying/206195/1 "2019-11-01T16:53:27Z")

</div>

I have an index that I've created that follows the ECS standard. Within the index I have the source.as.\* and destination.as.\* fields that are populated using the GeoLite2ASN database. The fields are being populated in the index, but the network section of SIEM doesn't display them. The main page nor the drilled down view of the IP shows this information. I verified with the "inspect" feature that I am populating the right fields. This is on version 7.4.0 if that matters.

Here's a sample that doesn't show the ASN in SIEM, but does show in searches. Any ideas what I might be missing/doing incorrectly?

```
{
  "source": {
    "ip": "192.168.1.1",
    "interface": "X16",
    "mac": "00:00:00:00:00:00",
    "bytes": 119311,
    "port": "62190"
  },
  "agent": {
    "type": "logstash",
    "name": "vDEVLOG1"
  },
  "observer": {
    "type": "firewall",
    "ip": "1.1.1.1",
    "serial_number": "NA",
    "vendor": "unknown"
  },
  "message": "%{[message][1]}",
  "destination": {
    "port": "443",
    "as": {
      "asn": 46489,
      "as_org": "Twitch Interactive Inc.",
      "ip": "52.223.226.232"
    },
    "interface": "X5",
    "ip": "52.223.226.232",
    "geo": {
      "location": {
        "lat": 47.6348,
        "lon": -122.3451
      },
      "longitude": -122.3451,
      "country_code3": "US",
      "postal_code": "98109",
      "region_code": "WA",
      "continent_code": "NA",
      "city_name": "Seattle",
      "ip": "52.223.226.232",
      "latitude": 47.6348,
      "dma_code": 819,
      "region_name": "Washington",
      "country_code2": "US",
      "timezone": "America/Los_Angeles",
      "country_name": "United States"
    },
    "bytes": 17384244,
    "mac": "40:a6:e8:5f:ba:d6"
  },
  "network": {
    "protocol": "https",
    "transport": "tcp",
    "bytes": 17503555
  },
  "host": {
    "ip": "192.168.1.1"
  },
  "url": {
    "domain": "video-edge-eddcc8.ord02.abs.hls.ttvnw.net",
    "path": "/v1/"
  },
  "@version": "1",
  "id": "a-fw",
  "tags": [
    "syslog",
    "unknown",
    "privateip_source"
  ],
  "@timestamp": "2019-10-31T23:00:02.000Z",
  "_index": "syslog-1.0-000028",
  "_type": "_doc",
  "_id": "aKUMJG4B3alxQ_lAFsNy",
  "_score": 1
}
```

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [November 1, 2019, 5:41pm UTC](https://discuss.elastic.co/t/autonomous-system-number-asn-not-displaying/206195/2 "2019-11-01T17:41:23Z")

</div>

The `destination.as.*` fields you have populated are not what is defined in Elastic Common Schema. See [https://www.elastic.co/guide/en/ecs/current/ecs-as.html](https://www.elastic.co/guide/en/ecs/current/ecs-as.html).

You'll want to have a `destination.as.number` and `destination.as.organization.name`.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [November 1, 2019, 5:44pm UTC](https://discuss.elastic.co/t/autonomous-system-number-asn-not-displaying/206195/3 "2019-11-01T17:44:08Z")

</div>

Here's an example you can follow for your Ingest Node pipeline.

> <https://github.com/elastic/beats/blob/7d453e3723eb9c8a756cee1d48a97b568f0442ca/x-pack/filebeat/module/cisco/ios/ingest/pipeline.yml#L3-L46>

It's in YAML, but you can convert it to JSON with [https://www.json2yaml.com/](https://www.json2yaml.com/).

---

<div class="post-metadata">

**Author:** ![Justin\_Doles](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/justin_doles/32/40730_2.png) [@Justin\_Doles](https://discuss.elastic.co/u/Justin_Doles)\
**Post date:** [November 1, 2019, 7:58pm UTC](https://discuss.elastic.co/t/autonomous-system-number-asn-not-displaying/206195/4 "2019-11-01T19:58:09Z")

</div>

That would make sense. I'm guessing the easiest way to accomplish this would be to use the mutate rename filter in Logstash?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 29, 2019, 7:58pm UTC](https://discuss.elastic.co/t/autonomous-system-number-asn-not-displaying/206195/5 "2019-11-29T19:58:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.