I am using a script to tidy up old indexes and get all the data consistent. Later indexes have geoip information for ip addresses but older ones don't.
I can't figure out how to explicitly invoke a geoip lookup in a script and then assign the some of the fields returned to fields in the mapping.
The older indexes have a text field for the ip the later ones have a different field name and ip type so the first thing I will do assign src_ip = ip.