postal_code missing from geo object?

[willemdh]

It seems like postal_code is missing from geoip object? When I use the geoip filter in Logstash,

The following fields are mapped with the Logstash geoip filter:

  | t destination.geo.city_name | Ghent
  | t destination.geo.continent_code | EU
  | t destination.geo.country_code2 | BE
  | t destination.geo.country_code3 | BE
  | t destination.geo.country_name | Belgium
  | t destination.geo.ip | 22.12.26.150
  | # destination.geo.latitude | 51.047
  | destination.geo.location | {   "lat": 51.047,   "lon": 3.7206 }
  | # destination.geo.longitude | 3.721
  | # destination.geo.postal_code | 9,000
  | t destination.geo.region_code | VOV
  | t destination.geo.region_name | East Flanders Province
  | t destination.geo.timezone | Europe/Brussels

So there seem to be multiple differences compared to what's already in geoip in ECS? postal_code gets mapped as long,as most postal codes are a number, but not all, resulting in mapping conflicts..

Also I'm having some thoughts on some geoip ecs fields. Didn't we prefer to use objects where possible. So shouldn't geoip be mapped to

geo.region.code instead of geo.region_code
geo.region.name instead of geo.region_name
...

?

[ebeahan]

Closing in favor of more recent discussion in #1217