How to convert string to geoip datatype while ingesting data from logstash to elastic search

Hi all,

I have a log field by default as string src_ip = I am able to have it as ip datatype in kibana by running default mappings API.

But for visualization, I need this as geoip datatype so that it can be used in coordinate or region maps

I am ingesting data from logstash to elastic-search.

Can anyone help me on this to get src_ip field as geoip.i had also tried geoip processor as -
geoip {
source => "source_ip"
but it doesn't worked out this still as string datatype in kibana.

geoip { source => "source_ip" }

will write geo information into the field geoip. If you change that to overwrite source_ip using the target option you will have to add a template to your index.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.