I know there are gazillion other posts but I have tried pretty much anything at this point.
Background: I am using AWS Opendistro and send events using Logstash both versions 7.4.0
Indexing template:
{
"panos-traffic" : {
"order" : 0,
"version" : 2,
"index_patterns" : [
"traffic*"
],
"settings" : {
"index" : {
"refresh_interval" : "5s"
}
},
"mappings" : {
"properties" : {
"RepeatCount" : {
"type" : "long"
},
"type" : {
"ignore_above" : 256,
"type" : "keyword"
},
"DestinationPort" : {
"type" : "integer"
},
"GeneratedTime" : {
"format" : "yyyy/MM/dd HH:mm:ss||yyyy/MM/dd||epoch_millis",
"type" : "date"
},
"Bytes" : {
"type" : "long"
},
"path" : {
"ignore_above" : 256,
"type" : "keyword"
},
"SessionEndReason" : {
"ignore_above" : 256,
"type" : "keyword"
},
"SourceZone" : {
"ignore_above" : 256,
"type" : "keyword"
},
"TimeLogged" : {
"format" : "yyyy/MM/dd HH:mm:ss||yyyy/MM/dd||epoch_millis",
"type" : "date"
},
"SCTP_Received" : {
"type" : "integer"
},
"SequenceNumber" : {
"type" : "long"
},
"TunnelID_IMSI" : {
"type" : "long"
},
"host" : {
"ignore_above" : 256,
"type" : "keyword"
},
"NATSourceIP" : {
"type" : "ip"
},
"DestinationLocation" : {
"ignore_above" : 256,
"type" : "keyword"
},
"NATDestinationPort" : {
"type" : "integer"
},
"RuleName" : {
"ignore_above" : 256,
"type" : "keyword"
},
"PacketsReceived" : {
"type" : "long"
},
"PacketsSent" : {
"type" : "long"
},
"syslog_host" : {
"ignore_above" : 256,
"type" : "keyword"
},
"MonitorTag_IMEI" : {
"ignore_above" : 256,
"type" : "keyword"
},
"StartTime" : {
"format" : "yyyy/MM/dd HH:mm:ss||yyyy/MM/dd||epoch_millis",
"type" : "date"
},
"DestinationIPGeo" : {
"properties" : {
"timezone" : {
"ignore_above" : 256,
"type" : "keyword"
},
"ip" : {
"type" : "ip"
},
"latitude" : {
"type" : "half_float"
},
"continent_code" : {
"ignore_above" : 256,
"type" : "keyword"
},
"city_name" : {
"ignore_above" : 256,
"type" : "keyword"
},
"country_code2" : {
"ignore_above" : 256,
"type" : "keyword"
},
"country_name" : {
"ignore_above" : 256,
"type" : "keyword"
},
"dma_code" : {
"type" : "short"
},
"country_code3" : {
"ignore_above" : 256,
"type" : "keyword"
},
"location" : {
"type" : "geo_point"
},
"region_name" : {
"ignore_above" : 256,
"type" : "keyword"
},
"postal_code" : {
"type" : "short"
},
"longitude" : {
"type" : "half_float"
},
"region_code" : {
"ignore_above" : 256,
"type" : "keyword"
}
}
},
"tags" : {
"ignore_above" : 256,
"type" : "keyword"
},
"DeviceGroupHierarchyLevel4" : {
"type" : "short"
},
"DeviceGroupHierarchyLevel3" : {
"type" : "short"
},
"LogForwardingProfile" : {
"ignore_above" : 256,
"type" : "keyword"
},
"SerialNumber" : {
"ignore_above" : 256,
"type" : "keyword"
},
"DeviceGroupHierarchyLevel2" : {
"type" : "short"
},
"SourceUser" : {
"ignore_above" : 256,
"type" : "keyword"
},
"DeviceGroupHierarchyLevel1" : {
"type" : "short"
},
"SourceVMUUID" : {
"ignore_above" : 256,
"type" : "keyword"
},
"ParentStartTime" : {
"format" : "yyyy/MM/dd HH:mm:ss||yyyy/MM/dd||epoch_millis",
"type" : "date"
},
"BytesSent" : {
"type" : "long"
},
"Dest_geoLocation" : {
"type" : "geo_point"
},
"ReceiveTime" : {
"format" : "yyyy/MM/dd HH:mm:ss||yyyy/MM/dd||epoch_millis",
"type" : "date"
},
"ActionFlags" : {
"ignore_above" : 256,
"type" : "keyword"
},
"DestinationZone" : {
"ignore_above" : 256,
"type" : "keyword"
},
"Application" : {
"ignore_above" : 256,
"type" : "keyword"
},
"SessionID" : {
"type" : "long"
},
"NATSourcePort" : {
"type" : "integer"
},
"SourceLocation" : {
"ignore_above" : 256,
"type" : "keyword"
},
"VirtualSystem" : {
"ignore_above" : 256,
"type" : "keyword"
},
"Action" : {
"ignore_above" : 256,
"type" : "keyword"
},
"VirtualSystemName" : {
"ignore_above" : 256,
"type" : "keyword"
},
"InboundInterface" : {
"ignore_above" : 256,
"type" : "keyword"
},
"SCTP_Sent" : {
"type" : "integer"
},
"ParentSessionID" : {
"type" : "integer"
},
"ElapsedTime" : {
"type" : "long"
},
"SourcePort" : {
"type" : "integer"
},
"Rule_UUID" : {
"ignore_above" : 256,
"type" : "keyword"
},
"URLCategory" : {
"ignore_above" : 256,
"type" : "keyword"
},
"OutboundInterface" : {
"ignore_above" : 256,
"type" : "keyword"
},
"SourceIP" : {
"type" : "ip"
},
"Packets" : {
"type" : "long"
},
"@version" : {
"type" : "byte"
},
"SourceIPGeo" : {
"properties" : {
"timezone" : {
"ignore_above" : 256,
"type" : "keyword"
},
"ip" : {
"type" : "ip"
},
"latitude" : {
"type" : "half_float"
},
"continent_code" : {
"ignore_above" : 256,
"type" : "keyword"
},
"city_name" : {
"ignore_above" : 256,
"type" : "keyword"
},
"country_code2" : {
"ignore_above" : 256,
"type" : "keyword"
},
"country_name" : {
"ignore_above" : 256,
"type" : "keyword"
},
"dma_code" : {
"type" : "long"
},
"country_code3" : {
"ignore_above" : 256,
"type" : "keyword"
},
"location" : {
"type" : "geo_point"
},
"region_name" : {
"ignore_above" : 256,
"type" : "keyword"
},
"postal_code" : {
"ignore_above" : 256,
"type" : "keyword"
},
"longitude" : {
"type" : "half_float"
},
"region_code" : {
"ignore_above" : 256,
"type" : "keyword"
}
}
},
"Protocol" : {
"ignore_above" : 256,
"type" : "keyword"
},
"Threat_ContentType" : {
"ignore_above" : 256,
"type" : "keyword"
},
"DestinationUser" : {
"ignore_above" : 256,
"type" : "keyword"
},
"geoip" : {
"dynamic" : true,
"properties" : {
"ip" : {
"type" : "ip"
},
"latitude" : {
"type" : "half_float"
},
"location" : {
"type" : "geo_point"
},
"longitude" : {
"type" : "half_float"
}
}
},
"FUTURE_USE" : {
"ignore_above" : 256,
"type" : "keyword"
},
"TunnelType" : {
"ignore_above" : 256,
"type" : "keyword"
},
"DestinationVMUUID" : {
"ignore_above" : 256,
"type" : "keyword"
},
"SCTP_AssocID" : {
"ignore_above" : 256,
"type" : "keyword"
},
"NATDestinationIP" : {
"type" : "ip"
},
"HTTP_Connection" : {
"ignore_above" : 256,
"type" : "keyword"
},
"Flags" : {
"ignore_above" : 256,
"type" : "keyword"
},
"BytesReceived" : {
"type" : "long"
},
"DestinationIP" : {
"type" : "ip"
},
"Type" : {
"ignore_above" : 256,
"type" : "keyword"
},
"@timestamp" : {
"type" : "date"
},
"geoLocation" : {
"type" : "geo_point"
},
"ActionSource" : {
"ignore_above" : 256,
"type" : "keyword"
},
"DeviceName" : {
"ignore_above" : 256,
"type" : "keyword"
},
"SCTP_Chunks" : {
"type" : "integer"
}
}
},
"aliases" : { }
}
}
filter:
geoip {
source => "DestinationIPGeo.location"
}
geoip {
source => "SourceIPGeo.location"
}
In Kibana: