Python agent are not filling context.user.ip field?

[fr0der1c]

Kibana version: 6.6.0

Elasticsearch version:6.6.0

APM Server version:6.6.0

APM Agent language and version: Python 4.1.0

I notice there is a context.user.ip field according to APM-Server doc. Is there any reason the Python agent not automatically fill in this field? I want to do a user IP pie chart visualization and I found the Python agent didn't collect this information.

elasticapm.set_user_context() don't have a IP field either.

[axw (Andrew Wilkins)]

context.user.ip is set by the APM Server, but only for RUM (browser) transactions. For other transactions, context.system.ip is recorded, but that's the IP of the system on which the agent is running.

For the end-user IP, you can use context.request.socket.remote_address. See https://www.elastic.co/guide/en/apm/server/current/transaction-indices.html for an example.

[fr0der1c]

Thank you.
I see context.request.socket.remote_address is not in Kibana index patterns by default. Do I have to use Elasticsearch Mapping API to make this field aggregatable in order to make a user IP pie chart?

[axw (Andrew Wilkins)]

Sorry for the late reply. Yes, you'll need to modify the mapping to index it, giving it an ip type. There is an experimental configuration in the server to simplify doing this, but we found a bug that prevents it from being used in this case: https://github.com/elastic/apm-server/issues/1959.

If you update the apm-6.6 template, then new daily indices will be created with this mapping. If you want to be able to chart existing data, you will need to reindex.

[fr0der1c]

Thank you for your suggestion. I end up in using Filebeat Nginx log to build my visitor IP pie chart.