If you use source => "client" in your Geoip filter and index into the default index name I think the existing template should take care of that for you.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.