search

logstash-plugins / logstash-filter-geoip

Apache License 2.0
64 stars 82 forks source link

Fix ECS field region_iso_code #205

Closed kaisecheng closed 2 years ago

kaisecheng commented 2 years ago

This commit changes the ECS field from geo.region_code to geo.region_iso_code

Before this change, 52.168.174.229 gives region_code: VA

The source of region_code is Maxmind iso_code. region_code is not a ECS field but region_iso_code is. In ECS example the value ofregion_iso_code is CA-QC, which seems to be a combination of country iso code and region iso code. So, the current region_code is not the same as ECS schema region_iso_code.

Questions:

  1. Can we change geo.region_code to geo.region_iso_code or keep it as is?

Fixed: #195

kaisecheng commented 2 years ago

need to combine country iso code and region iso code instead of renaming the field