I've read the documentation, but not understand what is the way the Filebeat is supposed to work with geo data, especially the NGINX module.
I installed an ES instance, installed the ingest geo ip and ingest user agent modules, and Kibana.
On my webservers I've installed Filebeat, configured the output to ES (bypassing Logstash).
I installed the templates for ES and the dashboards for Kibana.
Everything is showing up in the dashboards on Kibana properly, except the map, which is not showing the data.
How should it work? On which stage the entry from my log file get's an geoip information?
From my understanding the only component which is able to do that is currently ES...
Can somebody explain the workflow or post a link to some explaining documentation?