GeoIP lookup without logstash or ingestnode pipeline

meetdave2611997 · April 2, 2018, 5:59am

I want to do exactly what geoIP filter does in logstash and elasticsearch's pipeline but i dont have either .

I have one forwarder configured which is using elasticsearch's bulk api to ingest data. Now i want to create coordinate map in kibana which requires geo point data type.

Is there any way i can get coordinates of ipaddress in kibana?

Thanks,
Meet Dave

Christian_Dahlqvist · April 2, 2018, 7:14am

No, there is not. You will need to add this information to the documents during indexing. Can you not modify the ingest process to include Logstash or an ingest pipeline?

meetdave2611997 · April 10, 2018, 8:23pm

Data is coming from another source and I don't have control on that

Christian_Dahlqvist · April 10, 2018, 8:48pm

Then I unfortunately don't see any good way to achieve what you are looking for.

meetdave2611997 · April 11, 2018, 8:15am

Okay thank you

Christian_Dahlqvist · April 11, 2018, 8:42am

One thing you might be able do is to periodically run an update by query job that selects all documents that do not already have geoip fields and then use an ingest pipeline to update them. This reprocessing will however add additional load and lag a bit.

system · May 9, 2018, 8:42am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.