[[add-observer-metadata]]
=== Add Observer metadata

++++
<titleabbrev>add_observer_metadata</titleabbrev>
++++

beta[]

[source,yaml]
-------------------------------------------------------------------------------
processors:
  - add_observer_metadata:
      cache.ttl: 5m
      geo:
        name: nyc-dc1-rack1
        location: 40.7128, -74.0060
        continent_name: North America
        country_iso_code: US
        region_name: New York
        region_iso_code: NY
        city_name: New York
-------------------------------------------------------------------------------

It has the following settings:

`netinfo.enabled`:: (Optional) Default true. Include IP addresses and MAC addresses as fields observer.ip and observer.mac

`cache.ttl`:: (Optional) The processor uses an internal cache for the observer metadata. This sets the cache expiration time. The default is 5m, negative values disable caching altogether.

`geo.name`:: (Optional) User definable token to be used for identifying a discrete location. Frequently a datacenter, rack, or similar.

`geo.location`:: (Optional) Longitude and latitude in comma separated format.

`geo.continent_name`:: (Optional) Name of the continent.

`geo.country_name`:: (Optional) Name of the country.

`geo.region_name`:: (Optional) Name of the region.

`geo.city_name`:: (Optional) Name of the city.

`geo.country_iso_code`:: (Optional) ISO country code.

`geo.region_iso_code`:: (Optional) ISO region code.


The `add_geo_metadata` processor annotates each event with relevant metadata from the observer machine.
The fields added to the event look like the following:

[source,json]
-------------------------------------------------------------------------------
{
  "observer" : {
    "hostname" : "avce",
    "type" : "heartbeat",
    "vendor" : "elastic",
    "ip" : [
      "192.168.1.251",
      "fe80::64b2:c3ff:fe5b:b974",
    ],
    "mac" : [
      "dc:c1:02:6f:1b:ed",
    ],
    "geo": {
      "continent_name": "North America",
      "country_iso_code": "US",
      "region_name": "New York",
      "region_iso_code": "NY",
      "city_name": "New York",
      "name": "nyc-dc1-rack1",
      "location": "40.7128, -74.0060"
    }
  }
}
-------------------------------------------------------------------------------
