Due to a change in log format, the IP addresses I want to do a geo lookup on might be stored under "data.ip" for new logs, or just "ip" for older logs. I want to do the equivalent of:
| lookup latitude, longitude, city, country_name
from geo://location on ip=(%data.ip or ip)
Is there a way to do this?
Please sign in to leave a comment.