Is the possible to use Kibana Scripted fields (Using Painless) to convert an IP address field (that is currently indexed as a string) to a GeoJSON object (geoip datatype) field?
That is not possible. Scripted fields exist to compute results from field values. Scripted fields can not be used to look up additional values. In this instance, there is no way in painless to look up the geoip information for an IP address.
I would recommend using an ingest-pipeline to set up geoip, https://www.elastic.co/guide/en/elasticsearch/reference/master/geoip-processor.html#using-ingest. Or using the enrich processor to enrich documents in your index with geo-ip
Thank you.
@Nathan_Reese
Is this limitation by design?
Why not enable scripts to run processors (such as geoip) the same way, as ingest pipeline can?
This would have been very useful in our use case where we simply have to convert an ip field from string to geo_point. Reindexing supports using scripts but that too does not allow a geoip look up do, which makes the whole operation a little tedious. Curious to see what Nathan responds with.
If nothing works, we would have to rerun our existing indices through a logstash pipeline and index it back into ES.
Scripted fields run during query execution. The script is run for each document. Running something that has to perform a look up would be very resource intensive, greatly slow queries, and not scale. Its best to put all information into the document at ingest time.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.