@rgroleau welcome to the forum!
What you're recording sounds to me like it fits with the definition of client.geo.location in ECS (Elastic Common Schema). I think it would be sensible for the Elastic APM agents to provide a more specific API to record this information, and then we could record it with the correct field name and type – something like the apm.setGeoLocation()
you propose.
Would that work for you? If so, I'll open a feature request to track it.
In the mean time you can use an Ingest node pipeline to rename labels.location
to client.geo.location
:
- Create a "rename_location" pipeline:
PUT /_ingest/pipeline/rename_location
{
"description" : "rename labels.location to client.geo.location",
"processors" : [
{
"rename" : {
"field": "labels.location",
"target_field": "client.geo.location",
"ignore_missing": true
}
}
]
}
- Query the existing "apm" pipeline:
GET /_ingest/pipeline/apm
Elasticsearch responds with something like::
{
"apm" : {
"description" : "Default enrichment for APM events",
"processors" : [
{
"pipeline" : {
"name" : "apm_user_agent"
}
},
{
"pipeline" : {
"name" : "apm_user_geo"
}
},
{
"pipeline" : {
"name" : "apm_ingest_timestamp"
}
}
]
}
}
- Update "apm" pipeline to call the new "rename_locations" pipeline:
PUT /_ingest/pipeline/apm
{
"description": "Default enrichment for APM events",
"processors": [
{
"pipeline": {
"name": "apm_user_agent"
}
},
{
"pipeline": {
"name": "apm_user_geo"
}
},
{
"pipeline": {
"name": "apm_ingest_timestamp"
}
},
{
"pipeline": {
"name": "rename_location"
}
}
]
}