The basic GeoIP plugin provides this information when available, we should add it to ECS.

Note that I think there's more to add in the geo field set, but this one is straightforward.