Cherry-pick #9392 to 6.x: Add geo fields to add_host_metadata
processor.
#9565
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Cherry-pick of PR #9392 to 6.x branch. Original message:
** EDIT ** I've left the original issue below the break, but after discussion we added geo fields to the
add_host_metadata
processor instead of a new one. Original is belowThis carries over from the discussion from #8620 .
This adds a new processor that lets users easily add geo fields associated with the host that created the event. You would use it like so:
It's debate-able whether ECS should actually let you put these under perhaps
agent.geo
. That's something we should discuss here.One other question here, should we just fold this functionality under
add_host_metadata
? I believe that probably makes more sense. We agreed in #8620 to make this a separate processor, but with the data nested under host, that makes less sense IMHO.