We're running on Elastic Stack 7.5 and have all of our Beats output being sent to Logstash. Then from Logstash, output is sent to Elasticsearch and Kibana.
Using this flow, we have been unsuccessful in implementing geoIP data so that we can have Kibana plot source and destination IP addresses in its maps (in both "Map" and in SIEM/Network Map). However, when we change a Beats output to Elasticsearch (bypassing Logstash), maps are populating in SIEM/Network Map.
Our goal was to send all Beats output to Logstash and centrally-manage via Logstash. However, we are unable to populate maps via Logstash.
If we add a second Logstash output to the Beat for geoIP, geoIP data is not being populated in geoIP fields:
hosts: ["host IP address:5044"]
If we add a separate output in Beats to Elasticsearch (and retain the Logstash output config), dedicated-to processing/populating geoIP data, the Beats service fails to start:
hosts: ["host IP address:9200"]