GeoIP lookup without logstash or ingestnode pipeline

Elastic Stack Kibana
1

I want to do exactly what geoIP filter does in logstash and elasticsearch's pipeline but i dont have either .

I have one forwarder configured which is using elasticsearch's bulk api to ingest data. Now i want to create coordinate map in kibana which requires geo point data type.

Is there any way i can get coordinates of ipaddress in kibana?

Thanks,
Meet Dave

2

No, there is not. You will need to add this information to the documents during indexing. Can you not modify the ingest process to include Logstash or an ingest pipeline?

3

Data is coming from another source and I don't have control on that

4

Then I unfortunately don't see any good way to achieve what you are looking for.

5

Okay thank you

6

One thing you might be able do is to periodically run an update by query job that selects all documents that do not already have geoip fields and then use an ingest pipeline to update them. This reprocessing will however add additional load and lag a bit.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.