From 7de14549fefc319d3f11afba7561d4173e45f962 Mon Sep 17 00:00:00 2001 From: Karen Metts <35154725+karenzone@users.noreply.github.com> Date: Wed, 3 Sep 2025 12:47:19 -0400 Subject: [PATCH] Doc: Refine geoip filter example (#18101) Added sample output structure for geoip filter Co-authored-by: kaisecheng <69120390+kaisecheng@users.noreply.github.com> (cherry picked from commit 86ee4df168c1c9094f4a9e816fbbe9354f546992) --- docs/static/transforming-data.asciidoc | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/docs/static/transforming-data.asciidoc b/docs/static/transforming-data.asciidoc index 9c2e8125e7..ddd9a298d0 100644 --- a/docs/static/transforming-data.asciidoc +++ b/docs/static/transforming-data.asciidoc @@ -433,19 +433,28 @@ The <> adds geographical information about t filter { geoip { source => "clientip" + target => "[source]" } } -------------------------------------------------------------------------------- + -After the geoip filter is applied, the event will be enriched with geoip fields. +After the geoip filter is applied, the event is enriched with geoip fields. For example: + [source,json] -------------------------------------------------------------------------------- -filter { - geoip { - source => "clientip" - } +"source" => { + "geo" => { + "country_name" => "France", + "country_iso_code" => "FR", + "continent_code" => "EU", + "location" => { + "lon" => 2.3387, + "lat" => 48.8582 + }, + "timezone" => "Europe/Paris" + }, + "ip" => "82.67.74.30" } --------------------------------------------------------------------------------