add ECS compliant country_iso_code

[graphaelli]

Country code information is stored in country_code2 (and country_code3) while ECS dictates use of country_iso_code. I'm not familiar with how plugins are versioned but I expect this field could be added immediately and the non-ECS removed later?

city db:

logstash-filter-geoip/src/main/java/org/logstash/filters/GeoIPFilter.java

Lines 232 to 243 in 14676d9

	case COUNTRY_CODE2:
	String countryCode2 = country.getIsoCode();
	if (countryCode2 != null) {
	geoData.put(Fields.COUNTRY_CODE2.fieldName(), countryCode2);
	}
	break;
	case COUNTRY_CODE3:
	String countryCode3 = country.getIsoCode();
	if (countryCode3 != null) {
	geoData.put(Fields.COUNTRY_CODE3.fieldName(), countryCode3);
	}
	break;

country db:

logstash-filter-geoip/src/main/java/org/logstash/filters/GeoIPFilter.java

Lines 316 to 321 in 14676d9

	case COUNTRY_CODE2:
	String countryCode2 = country.getIsoCode();
	if (countryCode2 != null) {
	geoData.put(Fields.COUNTRY_CODE2.fieldName(), countryCode2);
	}
	break;

related to #92.

[ragri8]

Same thing with region_code which is referenced by region_iso_code in ECS.

The geoip processor available for ingest node already use country_iso_code and region_iso_code to store country and region codes informations.

Adding those fields shouldn't cause any issue for anyone and won't require a lot of work. I'm in favor for this issue to be solved and pushed as soon as possible, if anyone is willing to take it.

[kares]

@kaisecheng I think this is fully resolved by now and we can close the issue, right?

[kaisecheng]

@kares Thanks for checking this issue. Yes, country_code2 has mapped to geo.country_iso_code and country_code3 is removed in ECS. Hence, close the issue.