Closed dougburks closed 4 years ago
Looks like we might still be getting an extra geoip field from elasticsearch ingest node parsing: region_iso_code.
region_iso_code
We do have a region_code field in our template, so if this is the same field, it may just need to be renamed.
region_code
https://www.elastic.co/guide/en/logstash/7.x/plugins-filters-geoip.html
To test, please verify that Elasticsearch ingest node parsing now renames region_iso_code to region_code.
Published: https://blog.securityonion.net/2020/03/elastic-687-now-available-for-security.html
Looks like we might still be getting an extra geoip field from elasticsearch ingest node parsing:
region_iso_code
.We do have a
region_code
field in our template, so if this is the same field, it may just need to be renamed.https://www.elastic.co/guide/en/logstash/7.x/plugins-filters-geoip.html