1

I wanted to show the geolocation of my source.ip data on a map. I added a geoIP processor to my ingestion pipeline with target field source.geo, so now I get a field source.ip.location.

Initially, I mapped source in dynamic templates in the index mapping, but the field type was not being recognized (it showed in Kibana Discover with a question mark next to it). So I added the following manual mapping to the index:

"source": {
   "properties": {
       "ip": {
            "type": "ip"
        },
       "geo" :{
            "properties": {
                "region_iso_code":{
                    "type" : "keyword"
                },
                "country_iso_code":{
                    "type" : "keyword"
                },
                "location":{
                    "properties":{
                         "lat" : {
                             "type" : "long"
                          },
                         "lon" : {
                             "type" : "long"
                          }                          
                     }
                    "type" : "object"
                }
            },
            "type" : "object"
        }
    },
    "type": "object"
},

This made the field type appaer as a number in Kibana Discover/Visualize, however, it still didn't appear on Kibana's Security.Network Map.

Then I added source to the index template, and set the location as a geo-point type.

"source": {
   "properties": {
       "ip": {
            "type": "ip"
        },
       "geo" :{
            "properties": {
                },
                "region_iso_code":{
                    "type" : "keyword"
                },
                "country_iso_code":{
                    "type" : "keyword"
                },
                "location":{
                    "type" : "geo_point"
                }
            },
            "type" : "object"
        }
    },
    "type": "object"
},

When the index rolled over to the next one, the source.ip.location started to appear in Kibana's Discover with a red alert sign next to it, saying "analysis is not available for object fields". Needless to say, it still doesn't appear on the map, and now I have a conflict on the map's layer settings:

Data source: Documents
Index pattern: my_index_name
Geospatial field: source.geo.location
Geospatial field: type conflict

Any suggestions on how to get the geo_point data on the map?

Saba Far
  • 133
  • 2
  • 9

0 Answers0