While reindexing can I add geoip info to a record

I am using a script to tidy up old indexes and get all the data consistent. Later indexes have geoip information for ip addresses but older ones don't.

I can't figure out how to explicitly invoke a geoip lookup in a script and then assign the some of the fields returned to fields in the mapping.

The older indexes have a text field for the ip the later ones have a different field name and ip type so the first thing I will do assign src_ip = ip.

Why not use an ingest pipeline with a geoip processor when you reindex?

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.