diff --git a/CHANGELOG.md b/CHANGELOG.md
index feb2fb75f0..c73de83cea 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,7 @@ All notable changes to this project will be documented in this file based on the
### Breaking changes
* Change structure of URL. #7
* Rename `url.href` `multi_field`. #18
+* Rename `geoip.*` to `geo`.
### Bugfixes
diff --git a/README.md b/README.md
index 46e633b248..aeed62c5de 100644
--- a/README.md
+++ b/README.md
@@ -32,7 +32,7 @@ ECS defines these fields.
* [Error fields](#error)
* [Event fields](#event)
* [File fields](#file)
- * [Geoip fields](#geoip)
+ * [Geo fields](#geo)
* [Host fields](#host)
* [HTTP fields](#http)
* [Kubernetes fields](#kubernetes)
@@ -202,18 +202,18 @@ File fields provide details about each file.
| file.ctime | Last time file metadata changed. | date | | |
-## Geoip fields
+## Geo fields
-Geoip fields carry geo information for an ip address. The Elasticsearch geoip plugin can do the conversion to geoip.
+Geo fields can carry data about a specific location related to an event or geo information for an IP field.
| Field | Description | Type | Multi Field | Example |
|---|---|---|---|---|
-| geoip.continent_name | Name of the continent. | keyword | | |
-| geoip.country_iso_code | Country ISO code. | keyword | | |
-| geoip.location | Longitude and latitude. | geo_point | | |
-| geoip.region_name | Region name. | keyword | | |
-| geoip.city_name | City name. | keyword | | |
+| geo.continent_name | Name of the continent. | keyword | | |
+| geo.country_iso_code | Country ISO code. | keyword | | |
+| geo.location | Longitude and latitude. | geo_point | | |
+| geo.region_name | Region name. | keyword | | |
+| geo.city_name | City name. | keyword | | |
## Host fields
diff --git a/schema.csv b/schema.csv
index 3a028d6323..9f4b03821c 100644
--- a/schema.csv
+++ b/schema.csv
@@ -64,11 +64,11 @@ file.size,long,0,
file.target_path,text,0,
file.type,keyword,0,
file.uid,keyword,0,
-geoip.city_name,keyword,0,
-geoip.continent_name,keyword,0,
-geoip.country_iso_code,keyword,0,
-geoip.location,geo_point,0,
-geoip.region_name,keyword,0,
+geo.city_name,keyword,0,
+geo.continent_name,keyword,0,
+geo.country_iso_code,keyword,0,
+geo.location,geo_point,0,
+geo.region_name,keyword,0,
host.architecture,keyword,0,x86_64
host.id,keyword,1,
host.ip,ip,0,
diff --git a/schemas/geoip.yml b/schemas/geo.yml
similarity index 75%
rename from schemas/geoip.yml
rename to schemas/geo.yml
index 96d29f330b..ffc82a966e 100644
--- a/schemas/geoip.yml
+++ b/schemas/geo.yml
@@ -1,11 +1,10 @@
---
-- name: geoip
- title: Geoip
+- name: geo
+ title: Geo
group: 2
description: >
- Geoip fields carry geo information for an ip address.
- The Elasticsearch geoip plugin can do the conversion
- to geoip.
+ Geo fields can carry data about a specific location related to an event
+ or geo information for an IP field.
fields:
- name: continent_name
type: keyword
diff --git a/template.json b/template.json
index dd6d6339c3..6fd3539b67 100644
--- a/template.json
+++ b/template.json
@@ -325,7 +325,7 @@
}
}
},
- "geoip": {
+ "geo": {
"properties": {
"city_name": {
"ignore_above": 1024,