ECS Related geo doesn't work

[spartan782]

rock-dashboards/ecs-configuration/logstash/conf.d/logstash-900-filter-ecs-enrich.conf

Line 27 in b99c7ae

if [network][client][geo] {

Check appears to always pass the check because the object is created but is empty. Logstash does not appear to handle empty object checking very well and might need to be changed to a ruby block to make this work, or possibly checking further down the object? (didn't work in my local testing).

Related elastic link for the object checking.
https://discuss.elastic.co/t/how-to-check-if-a-hash-is-empty-no-keys/93227

[dcode]

@spartan782 what's the status on this? just tabling it for now? needs custom ruby?

[neu5ron]

yeah table this for now.. super low priority I think...
unless someone else wants to take a stab at it - I am putting this last on (my) list