From 9113e980b88846f80bcf74c5cd0086eef4bae8d6 Mon Sep 17 00:00:00 2001 From: Karen Metts <35154725+karenzone@users.noreply.github.com> Date: Wed, 3 Sep 2025 09:23:27 -0400 Subject: [PATCH] Doc: Provide accurate post-geoip lookup example (#18092) Co-authored-by: Kaise Cheng (cherry picked from commit 23d06e665ecbc89cecdaabe7b05adccb7f49b131) --- docs/reference/lookup-enrichment.md | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/docs/reference/lookup-enrichment.md b/docs/reference/lookup-enrichment.md index 45d81bf8ff..9c9ee74eec 100644 --- a/docs/reference/lookup-enrichment.md +++ b/docs/reference/lookup-enrichment.md @@ -65,17 +65,26 @@ $$$geoip-def$$$geoip filter filter { geoip { source => "clientip" + target => "[source]" } } ``` After the geoip filter is applied, the event will be enriched with geoip fields. For example: - ```json - filter { - geoip { - source => "clientip" - } + ```json + "source" => { + "geo" => { + "country_name" => "France", + "country_iso_code" => "FR", + "continent_code" => "EU", + "location" => { + "lon" => 2.3387, + "lat" => 48.8582 + }, + "timezone" => "Europe/Paris" + }, + "ip" => "82.67.74.30" } ```