snaki4
Results
3
comments of
snaki4
Good morning, Same issue seen by me. You do probably runs elastic 5.x where .raw has been changed to .keyword. This obligated you to change local_settings.py or settings.py with: from...
logstash 5.1 for some reason process dest_ip before, src_ip. Disabling dest_ip -> provides geoip.ip as src_ip instead of dest_ip. Anyone saw the same pls?
PR #46 should "add" this functionality