When using beats to ingest data we noticed that all geoip enrichments used by beats lack country_name field. Indeed geoip ingest processor lists the following defaults for properties field: [continent_name, country_iso_code, region_iso_code, region_name, city_name, location] and these defaults are used by beats.
We want country name added in all geo enrichments. Since we already have continent, region and city name why not the country name?
To do it we must update geoip processor configuration in the pipelines shipped with beats.
This requires additional work and maintenance as we either need to modify ingest pipelines shipped with beat modules or we can create new pipeline that calls beats pipeline as an inner one and in the parent one do the country name lookup.
In both cases out-of-the-box experience is poor.
Do you think we can add country_name to default value of properties?
When using beats to ingest data we noticed that all geoip enrichments used by beats lack
country_namefield. Indeed geoip ingest processor lists the following defaults forpropertiesfield:[continent_name, country_iso_code, region_iso_code, region_name, city_name, location]and these defaults are used by beats.We want
country nameadded in all geo enrichments. Since we already have continent, region and city name why not the country name?To do it we must update geoip processor configuration in the pipelines shipped with beats.
This requires additional work and maintenance as we either need to modify ingest pipelines shipped with beat modules or we can create new pipeline that calls beats pipeline as an inner one and in the parent one do the country name lookup.
In both cases out-of-the-box experience is poor.
Do you think we can add
country_nameto default value ofproperties?