Disable geoip

Elastic Stack Elasticsearch
1

Hello,

i have a logstash pipeline creating elasticsearch indices. Everytime a new index is created, geoip fields are already in the mappings. I do not use them and they never get filled with data. How do i stop them from getting added to my indices?

Pipeline config:

input { 
	jdbc { 
		jdbc_driver_class => "org.firebirdsql.jdbc.FBDriver"
		jdbc_connection_string => "jdbc:firebirdsql://...?encoding=ISO8859_1" 
		jdbc_user => "..." 
		jdbc_password => "..."
		statement_filepath => "...sql"
	}
}

output {
	elasticsearch {
		hosts => ["https://...", "https://...", "https://..."]
		ssl => true
		cacert => "...\elasticsearch-ca.pem"
		index => "logstash-test-%{+YYYY.MM.DD}"
		document_id => "%{persnr}"
		user => "logstash_internal"
		password => "..."
	}
}

image

Using Elastic, Logstash and Kibana 8.2

Best regards,
Jonas

2

I found the solution myself. For anyone wondering, you need to edit the logstash Index Template:

image
image1886×444 62 KB

And remove the geoip mappings on this page:
image
image1287×773 43.1 KB

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.