Private IP adress on a map

[3isenHeiM]

I'd like to add some map visualisation to the kibana dashboard. However the issue i'm facing is with internal IP address (private as in RFC 1918).

On the web I've found Logstash configuration to modify the geoIP fields of private IP addresses (for example here), but from the Documentation , the parsing needs to be done in ElasticSearch and I don't know where to d o it.

Where can I tell ES to add the geoIP data for interal private IP addresses?

Thanks !

[weslambert]

You can use the set processor combined with a conditional statement to set the value for specific fields:

https://www.elastic.co/guide/en/elasticsearch/reference/current/set-processor.html
https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#conditionally-run-processor

[3isenHeiM]

I've seen something like this:

PUT _ingest/pipeline/my-pipeline
{
  "processors": [
    {
      "set": {
        "description": "If 'source.ip' is private IP, set 'source.geo.city_name' to 'My City'",
        "if": "ctx?._source?.ip =~ /^(?:10|127|172\\.(?:1[6-9]|2[0-9]|3[01])|192\\.168)\\..*/",
        "field": "source.geo.city_name",
        "value": "My City"
      }
    }
  ]
}

And it returned

{
  "acknowledged": true
}

But this ingestor only works on the future data to come.
How can I run this over all the data already present in the ES stack ?