diff --git a/CHANGELOG.md b/CHANGELOG.md index feb2fb75f0..c73de83cea 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,7 @@ All notable changes to this project will be documented in this file based on the ### Breaking changes * Change structure of URL. #7 * Rename `url.href` `multi_field`. #18 +* Rename `geoip.*` to `geo`. ### Bugfixes diff --git a/README.md b/README.md index 46e633b248..aeed62c5de 100644 --- a/README.md +++ b/README.md @@ -32,7 +32,7 @@ ECS defines these fields. * [Error fields](#error) * [Event fields](#event) * [File fields](#file) - * [Geoip fields](#geoip) + * [Geo fields](#geo) * [Host fields](#host) * [HTTP fields](#http) * [Kubernetes fields](#kubernetes) @@ -202,18 +202,18 @@ File fields provide details about each file. | file.ctime | Last time file metadata changed. | date | | | -## Geoip fields +## Geo fields -Geoip fields carry geo information for an ip address. The Elasticsearch geoip plugin can do the conversion to geoip. +Geo fields can carry data about a specific location related to an event or geo information for an IP field. | Field | Description | Type | Multi Field | Example | |---|---|---|---|---| -| geoip.continent_name | Name of the continent. | keyword | | | -| geoip.country_iso_code | Country ISO code. | keyword | | | -| geoip.location | Longitude and latitude. | geo_point | | | -| geoip.region_name | Region name. | keyword | | | -| geoip.city_name | City name. | keyword | | | +| geo.continent_name | Name of the continent. | keyword | | | +| geo.country_iso_code | Country ISO code. | keyword | | | +| geo.location | Longitude and latitude. | geo_point | | | +| geo.region_name | Region name. | keyword | | | +| geo.city_name | City name. | keyword | | | ## Host fields diff --git a/schema.csv b/schema.csv index 3a028d6323..9f4b03821c 100644 --- a/schema.csv +++ b/schema.csv @@ -64,11 +64,11 @@ file.size,long,0, file.target_path,text,0, file.type,keyword,0, file.uid,keyword,0, -geoip.city_name,keyword,0, -geoip.continent_name,keyword,0, -geoip.country_iso_code,keyword,0, -geoip.location,geo_point,0, -geoip.region_name,keyword,0, +geo.city_name,keyword,0, +geo.continent_name,keyword,0, +geo.country_iso_code,keyword,0, +geo.location,geo_point,0, +geo.region_name,keyword,0, host.architecture,keyword,0,x86_64 host.id,keyword,1, host.ip,ip,0, diff --git a/schemas/geoip.yml b/schemas/geo.yml similarity index 75% rename from schemas/geoip.yml rename to schemas/geo.yml index 96d29f330b..ffc82a966e 100644 --- a/schemas/geoip.yml +++ b/schemas/geo.yml @@ -1,11 +1,10 @@ --- -- name: geoip - title: Geoip +- name: geo + title: Geo group: 2 description: > - Geoip fields carry geo information for an ip address. - The Elasticsearch geoip plugin can do the conversion - to geoip. + Geo fields can carry data about a specific location related to an event + or geo information for an IP field. fields: - name: continent_name type: keyword diff --git a/template.json b/template.json index dd6d6339c3..6fd3539b67 100644 --- a/template.json +++ b/template.json @@ -325,7 +325,7 @@ } } }, - "geoip": { + "geo": { "properties": { "city_name": { "ignore_above": 1024,