# Best practice for adding additional fields to transform

**URL:** <https://discuss.elastic.co/t/best-practice-for-adding-additional-fields-to-transform/379665>\
**Category:** Elasticsearch\
**Tags:** transforms\
**Created:** [July 1, 2025, 11:24am UTC](https://discuss.elastic.co/t/best-practice-for-adding-additional-fields-to-transform/379665 "2025-07-01T11:24:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dot-mike](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dot-mike/32/143339_2.png) [@dot-mike](https://discuss.elastic.co/u/dot-mike)\
**Post date:** [July 1, 2025, 11:24am UTC](https://discuss.elastic.co/t/best-practice-for-adding-additional-fields-to-transform/379665/1 "2025-07-01T11:24:34Z")

</div>

Hi community,

I've created a custom transform job to extract Fortigate VPN events into custom index to get start / stop time. Sharing it below for reference. This is extracting data from fortigate integration so we already have the geo fields in the source data.

I'm wondering that is the best practice for adding geoip fields to the data for `client.ip`?

Is it recommended to add a new custom ingest pipeline that uses `geoip` processor on the `client.ip` field?

```auto
PUT _transform/fortivpntunnels/_update
{
  "source": {
    "index": [
      "logs-*"
    ],
    "query": {
      "bool": {
        "filter": [
          {
            "bool": {
              "filter": [
                {
                  "bool": {
                    "should": [
                      {
                        "bool": {
                          "should": [
                            {
                              "term": {
                                "fortinet.firewall.action": {
                                  "value": "tunnel-down"
                                }
                              }
                            }
                          ],
                          "minimum_should_match": 1
                        }
                      },
                      {
                        "bool": {
                          "should": [
                            {
                              "term": {
                                "fortinet.firewall.action": {
                                  "value": "tunnel-up"
                                }
                              }
                            }
                          ],
                          "minimum_should_match": 1
                        }
                      },
                      {
                        "bool": {
                          "should": [
                            {
                              "term": {
                                "fortinet.firewall.action": {
                                  "value": "tunnel-stats"
                                }
                              }
                            }
                          ],
                          "minimum_should_match": 1
                        }
                      }
                    ],
                    "minimum_should_match": 1
                  }
                },
                {
                  "bool": {
                    "should": [
                      {
                        "exists": {
                          "field": "fortinet.firewall.tunnelip"
                        }
                      }
                    ],
                    "minimum_should_match": 1
                  }
                },
                {
                  "bool": {
                    "should": [
                      {
                        "exists": {
                          "field": "fortinet.firewall.xauthuser"
                        }
                      }
                    ],
                    "minimum_should_match": 1
                  }
                }
              ]
            }
          }
        ]
      }
    }
  },
  "pivot": {
    "group_by": {
      "observer.name": {
        "terms": {
          "field": "observer.name"
        }
      },
      "tunnel.id": {
        "terms": {
          "field": "fortinet.firewall.tunnelid"
        }
      },
      "tunnel.ip": {
        "terms": {
          "field": "fortinet.firewall.tunnelip"
        }
      },
      "client.ip": {
        "terms": {
          "field": "destination.ip"
        }
      },
      "username": {
        "terms": {
          "field": "fortinet.firewall.xauthuser"
        }
      }
    },
    "aggregations": {
      "tunnel.last.time": {
        "max": {
          "field": "@timestamp"
        }
      },
      "tunnel.first.time": {
        "min": {
          "field": "@timestamp"
        }
      }
    }
  },
  "description": "Transformation process that aggregates information about the start and end of VPN connections based on Fortinet events into an index",
  "frequency": "20s",
  "dest": {
    "index": "fortinet-vpn-tunnels"
  },
  "sync": {
    "time": {
      "delay": "10s",
      "field": "@timestamp"
    }
  },
  "retention_policy": {
    "time": {
      "field": "tunnel.first.time",
      "max_age": "180d"
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![Justin\_Castilla](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/justin_castilla/32/135379_2.png) [@Justin\_Castilla](https://discuss.elastic.co/u/Justin_Castilla)\
**Post date:** [July 1, 2025, 3:26pm UTC](https://discuss.elastic.co/t/best-practice-for-adding-additional-fields-to-transform/379665/2 "2025-07-01T15:26:06Z")

</div>

Hello,  
It might be worth it to check if any pipelines were created when you added the Fortigate integration that already geo enriches `client.ip` during the original ingest. You can check with `GET _ingest/pipeline/*fortinet*` or something similar.  
If not then I'd recommend your own pipeline:

```auto
PUT _ingest/pipeline/add-client-geo
{
  "description": "Add GeoIP data to client.ip",
  "processors": [
    {
      "geoip": {
        "field": "client.ip",
        "target_field": "client.geo",
        "ignore_missing": true
      }
    }
  ]
}

```

Then add it to your transform:

```auto
PUT _transform/fortivpntunnels/_update
{
  "dest": {
    "index": "fortinet-vpn-tunnels",
    "pipeline": "add-client-geo"
  }
}

```

---

<div class="post-metadata">

**Author:** ![dot-mike](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dot-mike/32/143339_2.png) [@dot-mike](https://discuss.elastic.co/u/dot-mike)\
**Post date:** [July 1, 2025, 9:37pm UTC](https://discuss.elastic.co/t/best-practice-for-adding-additional-fields-to-transform/379665/3 "2025-07-01T21:37:53Z")

</div>

Thanks for quick reply!