I want to enable the map which is present in SIEM app

Hi ,
I am having Elasticsearch version 7.4, and in the SIEM app network section I want to enable the map present. I want to enable it through my own index , so i am doing ECS mapping of my index field

but when i convert my client_ip to geoip field using geoip filter, field corresponding to geoip gets created . I want my client_ip filed to be coverted to 'source.geo.location'
field since the 'MAP' in SIEM APP gets generated through this field.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.