Geo *_IP_LOCATION in Elasticsearch about nprobe

[lucaderi]

In nProbe you have
[NFv9 57573][IPFIX 35632.101] %SRC_IP_COUNTRY Country where the src IP is located
[NFv9 57574][IPFIX 35632.102] %SRC_IP_CITY City where the src IP is located
[NFv9 57575][IPFIX 35632.103] %DST_IP_COUNTRY Country where the dst IP is located
[NFv9 57576][IPFIX 35632.104] %DST_IP_CITY City where the dst IP is located
that are the equivalent for nProbe

Furthermore in nProbe you need to do something like this we do for ntopng
https://github.com/ntop/ntopng/blob/dev/httpdocs/misc/ntopng_template_elk.json

This said I do not understand what you mean with "is possible to display location on Geo Map but there is no data in ES".

[lzalewsk]

Longitide and Lattitude are missing in export/
There is no data to map to geo_point so there is no possible to draw data on map.
Country and City are usefull but not enought/

[ValentinaViscarelli]

I added the export of longitude and latitude.
Now you have:

[NFv9 57920][IPFIX 35632.448] %SRC_IP_LONG Longitude where the src IP is located
[NFv9 57921][IPFIX 35632.449] %SRC_IP_LAT Latitude where the src IP is located
[NFv9 57922][IPFIX 35632.450] %DST_IP_LONG Longitude where the dst IP is located
[NFv9 57923][IPFIX 35632.451] %DST_IP_LAT Latitude where the dst IP is located

Overnight a new release will be built. You will be able to find them in new release.

[lzalewsk]

HI,
I confirme that location data are now exported but why you decided to split location on two fileds Long &Lat? In ntopng Location are exported like this:

    "SRC_IP_COUNTRY": "PL",
    "SRC_IP_LOCATION": [
      21,
      52.25
    ],
    "DST_IP_COUNTRY": "PL",
    "DST_IP_LOCATION": [
      21,
      52.25
    ]

From ES perspetive it is better format to carry out positioning on the Map using geo_point.
So to maintain consistancy between ntopng and nprobe I think that geo_point format is better.

[simonemainardi]

@ValentinaViscarelli do you think we should add an index template like in ntopng?

https://github.com/ntop/ntopng/blob/dev/src/Redis.cpp#L1186
https://github.com/ntop/ntopng/blob/aafac73593c49ae3b22fd47c13e9b96b4b45975b/httpdocs/misc/ntopng_template_elk.json