Error using IPv6 address with ingest geoip module

[rgl]

The IIS error log (e.g. C:\Windows\System32\LogFiles\HTTPERR\httperr1.log) has this line:

#Software: Microsoft HTTP API 2.0
#Version: 1.0
#Date: 2018-12-30 13:48:36
#Fields: date time c-ip c-port s-ip s-port cs-version cs-method cs-uri streamid sc-status s-siteid s-reason s-queuename
2018-12-30 14:22:07 ::1%0 49958 ::1%0 80 - - - - - - Timer_ConnectionIdle -

But the error.message atribute on the indexed document has '::1%0' is not an IP string literal..

It seems something needs to be changed to handle that IP format?

BTW, the %0 is the IPv6 zone id or index.

I'm using:

• Filebeat Version: 6.5.4
• Operating System: Windows 2019
• IIS: 10.0

[jsoriano]

I think the address is correctly being parsed, but then the geoip plugin complains about this, removing the geoip filter from the pipeline removes this error.

[jsoriano]

I have opened elastic/elasticsearch#37107 to discuss if this should be supported by the geoip processor. In the meantime we could try to workaround the issue by using a temporary field for geoip without the zone id.