Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove note describing workaround for client_ip field #2963

Merged
merged 1 commit into from
Nov 9, 2016
Merged

Remove note describing workaround for client_ip field #2963

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 0 additions & 26 deletions packetbeat/docs/packetbeat-geoip.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,32 +62,6 @@ when it encounters an event that doesn't have a `client_ip` field.
See
{plugindoc}/using-ingest-geoip.html[Using the Geoip Processor in a Pipeline]
for more options.
+
[NOTE]
===============================
The index template that ships with Packetbeat 5.0 does not specify a
mapping for the `client_geoip.location` field. To make sure the geoIP data gets
indexed correctly, you need to add the following lines to the Packetbeat index
template, `packetbeat.template.json`. Add these lines immediately before the
entry for `client_ip`:

[source,json]
"client_geoip": {
"properties": {
"location": {
"type": "geo_point"
}
}
},

If you've already loaded the index template, make sure you load it again (see
<<packetbeat-template,Loading the Index Template in Elasticsearch>>).

You must update the mappings before you send the geoIP data to ingest node
for the first time, or the location data will be incorrectly indexed as separate
float values instead of a `geo point`.

===============================

3. In the Packetbeat config file, configure the Elasticsearch output to use the
pipeline. Specify the pipeline ID in the `pipeline` option under
Expand Down