Hi Guys,
I am aware that I can use geoip { source => ...}
to get country name based on source IP . But My concern is I am getting less data on Map when I am using Geoip filter in LS . So what I have done is I used following in LS, as I already have long,lat fileds in the data.
mutate {
convert => {
"slat" => "float"
"slong" => "float"
}
add_field => {
"[geoip][location]" => [ "%{slong}", "%{slat}" ]
"[geoip][latitude]" => "%{slat}"
"[geoip][longitude]" => "%{slong}"
}
}
With this approach I am able to see data on Map but I am not getting country name out of it . I am also aware that I can use Geolight.city database for this but we do not want to spent money on this database .Please suggest if I can achieve this with above mentioned LS code ? Something like add another country field ?
Thanks
VG