We are running Filebeat 7.8.0, and utilising the Palo Alto module to ingest firewalls using ECS. When I go to display the source or destination IP addresses on on a map, I get a failure and no data points. According to the Kibana geo mapping information, the MAP processor is looking for a geo-point data type, normally found as "location" in the index. Looking at the data in my index, I can see:
text destination.geo.continent_name Oceania
test destination.geo.country_iso_code AU
number destination.geo.location.lat -33.49
number destination.geo.location.lon 143.21
text ecs.version 1.5.0
which technically matches the geoip definition, as shown by this snippet from the online documentation for 7.8:
"text": "Geo-point as an object",
However when I go to create a MAP, and it asks me to select an index pattern, it won't even show me the filebeat 7.8.0 index pattern, which according to the documentation is because it does not contain a definition of a geo-point in the index. Filebeat 7.7.0 index pattern defined "location" as a geo-point. 7.8.0 seems to define it as an object.
This has also broken all the built-in MAP displays.