Geo-location fields missing (no geoip)

[btmndkh]

Problem

Geo-location (GeoIP) information is missing in the indexed FortiGate logs.

In Kibana (Data view: logs-fortinet.fortigate*), I can see and use:

• fgt.dstcountry
• fgt.srccountry

…but there are no geo location fields available (searching geo returns no matching fields), so I can’t use Maps / geo aggregations.

Environment

• ELK / Elastic Stack: 9.2.1
• Integration / pipeline: fortinet-2-elasticsearch

[dr4gon123]

Are you using vector ? If so, we haven't implemented yet geo enrichment.

[btmndkh]

Yes. FG → Vector → Elasticsearch → Kibana.
Do you have any plans for geo enrichment soon?

[dr4gon123]

I guess I won't be so hard. So yes, probably late January.