Extend ingest_geoip ASN processing to utilise the MaxMind subnet information

[ansell]

This is a feature request to extend the MaxMind GeoIP2 ASN processing that was added in #27849 to also utilise the subnet that MaxMind expose in their GeoIP2 ASN API. I have found it necessary in the past to manually isolate particular subnets from ASN's when diagnosing issues. This feature request would automatically add that field to smooth diagnosis of particular issues.

The MaxMind API method that would be utilised is com.maxmind.geoip2.model.AsnResponse.getNetwork():

https://github.com/maxmind/GeoIP2-java/blob/master/src/main/java/com/maxmind/geoip2/model/AsnResponse.java#L70-L79

The main place where the feature request would need to be implemented is in org.elasticsearch.ingest.geoip.GeoIpProcessor.retrieveAsnGeoData:

elasticsearch/modules/ingest-geoip/src/main/java/org/elasticsearch/ingest/geoip/GeoIpProcessor.java

Lines 333 to 368 in 69a6a18

	private Map<String, Object> retrieveAsnGeoData(InetAddress ipAddress) {
	SpecialPermission.check();
	AsnResponse response = AccessController.doPrivileged((PrivilegedAction<AsnResponse>) () ->
	cache.putIfAbsent(ipAddress, AsnResponse.class, ip -> {
	try {
	return lazyLoader.get().asn(ip);
	} catch (AddressNotFoundException e) {
	throw new AddressNotFoundRuntimeException(e);
	} catch (Exception e) {
	throw new RuntimeException(e);
	}
	}));
	Integer asn = response.getAutonomousSystemNumber();
	String organization_name = response.getAutonomousSystemOrganization();
	Map<String, Object> geoData = new HashMap<>();
	for (Property property : this.properties) {
	switch (property) {
	case IP:
	geoData.put("ip", NetworkAddress.format(ipAddress));
	break;
	case ASN:
	if (asn != null) {
	geoData.put("asn", asn);
	}
	break;
	case ORGANIZATION_NAME:
	if (organization_name != null) {
	geoData.put("organization_name", organization_name);
	}
	break;
	}
	}
	return geoData;
	}

[elasticmachine]

Pinging @elastic/es-core-features (:Core/Features/Ingest)