I want to enable the map which is present in SIEM app

Elastic Security SIEM
1

Hi ,
I am having Elasticsearch version 7.4, and in the SIEM app network section I want to enable the map present. I want to enable it through my own index , so i am doing ECS mapping of my index field

but when i convert my client_ip to geoip field using geoip filter, field corresponding to geoip gets created . I want my client_ip filed to be coverted to 'source.geo.location'
field since the 'MAP' in SIEM APP gets generated through this field.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.