{
  "description": "GeoIP and ASN for traffic arriving on WAN",
  "processors": [
    { "ip2geo": {
        "if": "ctx.observer?.ingress?.interface?.alias == 'WAN' && ctx.source?.ip != null",
        "field": "source.ip",
        "datasource": "geolite2-city",
        "target_field": "source.geo",
        "properties": ["country_iso_code", "country_name", "continent_name", "region_name", "city_name", "location"],
        "ignore_missing": true,
        "ignore_failure": true
    } },
    { "ip2geo": {
        "if": "ctx.observer?.ingress?.interface?.alias == 'WAN' && ctx.source?.ip != null",
        "field": "source.ip",
        "datasource": "geolite2-asn",
        "target_field": "source.as",
        "properties": ["asn", "organization_name"],
        "ignore_missing": true,
        "ignore_failure": true
    } },
    { "rename": { "field": "source.as.asn", "target_field": "source.as.number", "ignore_missing": true } },
    { "rename": { "field": "source.as.organization_name", "target_field": "source.as.organization.name", "ignore_missing": true } }
  ]
}