Hey Community,
so basically i'm totally new to ES. I set up an Elk-Cluster with 2 Worker Node's, and a Master Node running Kibana etc.
I attached a security system to it via logstash, so now i get the syslogs and it all works out just fine.
I wanted to use the GeoIP Module because bosses love that stuff.
My Problem is, that the Firewall only attaches the IP address in a field call 'ui' but painfully its written like "ssh (x.x.x.x)" like 60% of the time. Instead of reconfiguring the Firewall, is there a way for me to convert this field into a type which fits my needs?
Sorry for asking something this low -level, but as i said, totally new in this field.
I know that it has something to do with the Mapping Configuration.
*"ui": {*
-
"type": "text",*
-
"norms": false,*
-
"fields": {*
-
"keyword": {*
-
"type": "keyword",*
-
"ignore_above": 256*
But yet i'm too new to this topic to know where to find this setting.
Greetz
Moritz