After Upgrading my elasticsearch and kibana to the latest version, geoip stopped working, everything else is working.
Can you please provide more details?
- What did you upgrade from / to ?
- What does "stopped working" mean?
- Is there an error message?
- Are fields being populated at all?
- Are these elastic supplied pipelines, or ones you have written?
- If you wrote them, can you provide an example?
I upgraded my elasticsearch and kibana to 8.16.0 from 8.15.0, before upgrading the destination.geo.country_name was working but after the upgrade it stopped showing any data, in the upgrade process it asked me if I wanted to live the default configuration and i typed yes, there are no error messages, and there are no fields populated in destination.geo.country_name, and everything is elastic supplied piplines
Can you share the pipeline, or tell us which integration is supposed to be populating this field? We definitely still support country name in 8.16.0.
It is the elastic pipeline, I didn’t configure or wrote my own pipeline, and I am not using logstash, it is forwarded by filebeat, and after my upgrade it stopped generating any data to any geo tab in kibana.
@Leb_Cryptos would it be possible for you to share the name of the index/indices for which the data that you're expecting to see isn't being populated? Ideally I'd also like to know the settings for those indices (specifically the default_pipeline).
Filebeat can work with dozens and dozens of different pipelines, and we need to figure out precisely which one you're actually using.
The name of the index/indices is "logs-*"
and these are the default_pipeline..
{
".ds-logs-endpoint.events.security-default-2024.10.26-000001": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-endpoint.events.security-default-2024.10.26-000001",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1729958780434",
"number_of_replicas": "1",
"uuid": "eYJ_NrCzTCuSdIbzyuPY7Q",
"version": {
"created": "8512000"
},
"lifecycle": {
"name": "logs",
"indexing_complete": "true"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-endpoint.events.security-8.16.0"
}
}
},
".ds-logs-endpoint.events.file-default-2024.10.26-000001": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-endpoint.events.file-default-2024.10.26-000001",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1729958778997",
"number_of_replicas": "1",
"uuid": "fw7N1tqBTDuRMldOiYG8Bw",
"version": {
"created": "8512000"
},
"lifecycle": {
"name": "logs",
"indexing_complete": "true"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-endpoint.events.file-8.16.0"
}
}
},
".ds-logs-windows.sysmon_operational-default-2024.10.28-000001": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-windows.sysmon_operational-default-2024.10.28-000001",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1730117454453",
"number_of_replicas": "1",
"uuid": "qLlE3kDnRNCo-PA3-LmZ4g",
"version": {
"created": "8512000"
},
"lifecycle": {
"name": "logs"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-windows.sysmon_operational-2.2.0"
}
}
},
".ds-logs-system.syslog-default-2024.10.31-000001": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-system.syslog-default-2024.10.31-000001",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1730372602099",
"number_of_replicas": "1",
"uuid": "tCknZUQ4SamaVanuOy3x8Q",
"version": {
"created": "8512000"
},
"lifecycle": {
"name": "logs"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-system.syslog-1.61.1"
}
}
},
".ds-logs-elastic_agent.endpoint_security-default-2024.10.28-000001": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-elastic_agent.endpoint_security-default-2024.10.28-000001",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1730117459457",
"number_of_replicas": "1",
"uuid": "uue5RshVRmunaz43Ogfzfg",
"version": {
"created": "8512000"
},
"lifecycle": {
"name": "logs"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-elastic_agent.endpoint_security-2.0.3"
}
}
},
".ds-logs-system.auth-default-2024.10.31-000001": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-system.auth-default-2024.10.31-000001",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1730372602190",
"number_of_replicas": "1",
"uuid": "uOuf-JA8TRKCxkXP_2uBVg",
"version": {
"created": "8512000"
},
"lifecycle": {
"name": "logs"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-system.auth-1.61.1"
}
}
},
".ds-logs-endpoint.events.process-default-2024.10.26-000001": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "10000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-endpoint.events.process-default-2024.10.26-000001",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1729958778974",
"number_of_replicas": "1",
"uuid": "nJZ_5F9RQtS757dAiMTkUQ",
"version": {
"created": "8512000"
},
"lifecycle": {
"name": "logs",
"indexing_complete": "true"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-endpoint.events.process-8.16.0"
}
}
},
".ds-logs-endpoint.events.api-default-2024.11.25-000002": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-endpoint.events.api-default-2024.11.25-000002",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1732551061875",
"number_of_replicas": "1",
"uuid": "15ZcGFW7TRWZ4z26GHMMxQ",
"version": {
"created": "8518000"
},
"lifecycle": {
"name": "logs"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-endpoint.events.api-8.16.0"
}
}
},
".ds-logs-endpoint.events.library-default-2024.10.26-000001": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-endpoint.events.library-default-2024.10.26-000001",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1729958779024",
"number_of_replicas": "1",
"uuid": "UO_w1LMJT8Oea-T6CIhQ6A",
"version": {
"created": "8512000"
},
"lifecycle": {
"name": "logs",
"indexing_complete": "true"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-endpoint.events.library-8.16.0"
}
}
},
".ds-logs-elastic_agent.fleet_server-default-2024.10.31-000001": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-elastic_agent.fleet_server-default-2024.10.31-000001",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1730372582414",
"number_of_replicas": "1",
"uuid": "Gdo5Z9TWRMS53Zae_cY-Tw",
"version": {
"created": "8512000"
},
"lifecycle": {
"name": "logs"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-elastic_agent.fleet_server-2.0.3"
}
}
},
".ds-logs-elastic_agent.filebeat-default-2024.10.28-000001": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-elastic_agent.filebeat-default-2024.10.28-000001",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1730117459475",
"number_of_replicas": "1",
"uuid": "yI8e-U6eQwOihIALxeeUNg",
"version": {
"created": "8512000"
},
"lifecycle": {
"name": "logs"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-elastic_agent.filebeat-2.0.3"
}
}
},
".ds-logs-endpoint.events.process-default-2024.11.25-000002": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "10000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-endpoint.events.process-default-2024.11.25-000002",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1732551062207",
"number_of_replicas": "1",
"uuid": "77BzkSIjQTO89T8WFKFwlg",
"version": {
"created": "8518000"
},
"lifecycle": {
"name": "logs"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-endpoint.events.process-8.16.0"
}
}
},
".ds-logs-endpoint.events.registry-default-2024.10.26-000001": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-endpoint.events.registry-default-2024.10.26-000001",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1729958779012",
"number_of_replicas": "1",
"uuid": "dSUBsZ2VT8a56b-g2wL4Qg",
"version": {
"created": "8512000"
},
"lifecycle": {
"name": "logs",
"indexing_complete": "true"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-endpoint.events.registry-8.16.0"
}
}
},
".ds-logs-windows.powershell-default-2024.10.28-000001": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-windows.powershell-default-2024.10.28-000001",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1730117454470",
"analysis": {
"analyzer": {
"powershell_script_analyzer": {
"pattern": """[\W&&[^-]]+""",
"type": "pattern"
}
}
},
"number_of_replicas": "1",
"uuid": "-H08GKxZSMGMvLkEQ0129A",
"version": {
"created": "8512000"
},
"lifecycle": {
"name": "logs"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-windows.powershell-2.2.0"
}
}
},
".ds-logs-endpoint.events.network-default-2024.10.26-000001": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-endpoint.events.network-default-2024.10.26-000001",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1729958778959",
"number_of_replicas": "1",
"uuid": "RA3u4tWiS1eVHLNJOMJJFA",
"version": {
"created": "8512000"
},
"lifecycle": {
"name": "logs",
"indexing_complete": "true"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-endpoint.events.network-8.16.0"
}
}
},
".ds-logs-endpoint.events.security-default-2024.11.25-000002": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-endpoint.events.security-default-2024.11.25-000002",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1732551062182",
"number_of_replicas": "1",
"uuid": "_g-rIiWeSUKtzQHs5WznGQ",
"version": {
"created": "8518000"
},
"lifecycle": {
"name": "logs"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-endpoint.events.security-8.16.0"
}
}
},
".ds-logs-elastic_agent-default-2024.10.28-000001": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-elastic_agent-default-2024.10.28-000001",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1730117459468",
"number_of_replicas": "1",
"uuid": "aZNvgdS8T-WoP4E4rZ0krw",
"version": {
"created": "8512000"
},
"lifecycle": {
"name": "logs"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-elastic_agent-2.0.3"
}
}
},
".ds-logs-endpoint.events.registry-default-2024.11.25-000002": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-endpoint.events.registry-default-2024.11.25-000002",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1732551061813",
"number_of_replicas": "1",
"uuid": "iVm-LjCWTj-AEgC8_00CeQ",
"version": {
"created": "8518000"
},
"lifecycle": {
"name": "logs"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-endpoint.events.registry-8.16.0"
}
}
},
".ds-logs-endpoint.events.api-default-2024.10.26-000001": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-endpoint.events.api-default-2024.10.26-000001",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1729958780444",
"number_of_replicas": "1",
"uuid": "DV-aOP92T0O1klYo1EMklg",
"version": {
"created": "8512000"
},
"lifecycle": {
"name": "logs",
"indexing_complete": "true"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-endpoint.events.api-8.16.0"
}
}
},
".ds-logs-endpoint.events.file-default-2024.11.25-000002": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-endpoint.events.file-default-2024.11.25-000002",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1732551061907",
"number_of_replicas": "1",
"uuid": "12X9gj1KQBehZcThbr7qjQ",
"version": {
"created": "8518000"
},
"lifecycle": {
"name": "logs"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-endpoint.events.file-8.16.0"
}
}
},
".ds-logs-windows.powershell_operational-default-2024.10.28-000001": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-windows.powershell_operational-default-2024.10.28-000001",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1730117454485",
"analysis": {
"analyzer": {
"powershell_script_analyzer": {
"pattern": """[\W&&[^-]]+""",
"type": "pattern"
}
}
},
"number_of_replicas": "1",
"uuid": "Q7VhtdPjScWapMwgtA8KSg",
"version": {
"created": "8512000"
},
"lifecycle": {
"name": "logs"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-windows.powershell_operational-2.2.0"
}
}
},
".ds-logs-elastic_agent.metricbeat-default-2024.10.30-000001": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-elastic_agent.metricbeat-default-2024.10.30-000001",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1730323811519",
"number_of_replicas": "1",
"uuid": "0RWNfTYaQ8qiU3UiPgtMmQ",
"version": {
"created": "8512000"
},
"lifecycle": {
"name": "logs"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-elastic_agent.metricbeat-2.0.3"
}
}
},
".ds-logs-endpoint.events.library-default-2024.11.25-000002": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-endpoint.events.library-default-2024.11.25-000002",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1732551061856",
"number_of_replicas": "1",
"uuid": "njSfu2QkTkSUkZI3iJ4frQ",
"version": {
"created": "8518000"
},
"lifecycle": {
"name": "logs"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-endpoint.events.library-8.16.0"
}
}
},
".ds-logs-system.security-default-2024.10.28-000001": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-system.security-default-2024.10.28-000001",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1730117454435",
"number_of_replicas": "1",
"uuid": "VB-JqojcQCyzGc47JG3PfQ",
"version": {
"created": "8512000"
},
"lifecycle": {
"name": "logs"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-system.security-1.61.1"
}
}
},
".ds-logs-system.system-default-2024.10.28-000001": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-system.system-default-2024.10.28-000001",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1730117454289",
"number_of_replicas": "1",
"uuid": "1msNi1LRQXeER0iXdYHolQ",
"version": {
"created": "8512000"
},
"lifecycle": {
"name": "logs"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-system.system-1.61.1"
}
}
},
".ds-logs-endpoint.events.network-default-2024.11.25-000002": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-endpoint.events.network-default-2024.11.25-000002",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1732551061842",
"number_of_replicas": "1",
"uuid": "2HvR8sb2RO-FMuke1h15Xw",
"version": {
"created": "8518000"
},
"lifecycle": {
"name": "logs"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-endpoint.events.network-8.16.0"
}
}
},
".ds-logs-system.application-default-2024.10.28-000001": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1000",
"ignore_dynamic_beyond_limit": "true"
},
"ignore_malformed": "true"
},
"hidden": "true",
"provided_name": ".ds-logs-system.application-default-2024.10.28-000001",
"final_pipeline": ".fleet_final_pipeline-1",
"creation_date": "1730117454421",
"number_of_replicas": "1",
"uuid": "_rP3jkWjRAKA5rzQ3A4EBQ",
"version": {
"created": "8512000"
},
"lifecycle": {
"name": "logs"
},
"mode": "standard",
"codec": "best_compression",
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"number_of_shards": "1",
"default_pipeline": "logs-system.application-1.61.1"
}
}
}
}
Let's try getting as specific as possible for a little -- what's one index where the destination.geo.country_name isn't being populated as you'd expect, and what's the default_pipeline for that one index, and can you include the first 20 lines of the result of calling GET _ingest/pipeline/$pipeline for the id of the pipeline that's the default_pipeline of that one problematic index?
I'm hoping we can figure out what's going on for one of those specific indices, and then we can widen from there.
1 Like