-
Notifications
You must be signed in to change notification settings - Fork 80
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
missing ECS fields #195
Comments
@emalzer ECS is not enabled by default in Logstash 7.15
and start logstash. |
@kaisecheng yes, you are right, I'm in the middle of mirgating to ECS and forgot the compatibility mode while trying to recreate the issue as simple as possible. I thus tried it again with the following configuration:
I attached the |
@emalzer I see your point! Looking at the example in ECS schema, I will try to make it to |
Fixed in #206 |
Logstash information:
Logstash installation source (e.g. built from source, with a package manager: DEB/RPM, expanded from tar or zip archive, docker)
DEB / Ubuntu 18.04
How is Logstash being run (e.g. as a service/service manager: systemd, upstart, etc. Via command line, docker/kubernetes)
systemd
How was the Logstash Plugin installed
core plugin
JVM (e.g.
java -version
):OS version (
uname -a
if on a Unix-like system):Description of the problem including expected versus actual behaviour:
The current ECS scheme (1.12) uses the field geo.region_iso_code field, the geoip filter plugin actually uses the geo.region_code field, which does not comply with the ECS scheme. Also it inserts the country_code2 and country_code3 (which is fine for me :) ), but not the geo.country_iso_code.
Steps to reproduce:
The text was updated successfully, but these errors were encountered: