Open
Description
What documentation page is affected
The GeoIP processor link misses the SET processor which is necessary for custom datasets. Without this users are left with 2 distinct fields (*.lat & *.lon).
What change would you like to see?
Add a set processor so folks will know how to apply, and a link to the mapping necessary for the field: geo-point mapping
{ "geoip": { "ignore_failure": true, "field": "threat.indicator.ip", "target_field": "threat.indicator.geo" } }, { "set": { "ignore_failure": true, "field": "threat.indicator.geo.location", "value": "{{threat.indicator.geo.location.lat}}, {{threat.indicator.geo.location.lon}}" } }
Additional info
No response