Update module ingest node templates to include geo_shapes when possible

[alexfrancoeur]

The new Maps app has a ton of cool new features, one of which allows us to plot individual geo_shapes and geo_points on a map. A cool out of the box example would be to draw a line between the source and destination of an event. This in particular would be useful for SIEM pew pew maps, RUM user traffic, uptime monitoring, etc.

Example

source.geo.location has the geo_point:

{
  "lat": 41.19272,
  "lon": -8.38768
}

destination.geo.location has the geo_point:

{
  "lat": 12.30954,
  "lon": 123.67961
}

If there is a way through an ingest node script processor to check for both locations, it'd be pretty cool to build this line out of the box.

{
  "type": "linestring",
  "coordinates": [
    [
      -8.38768,
      41.19272
    ],
    [
      123.67961,
      12.30954
    ]
  ]
}

Resulting in a map that looks like this:

https://github.com/alexfrancoeur/elastic_maps_examples

With or without this functionality, we should probably start thinking about shipping maps out of the box for some of these modules (especially when they can be embedded into dashboards soon) and embedding these maps into the actual solutions experiences (SIEM, uptime, etc.).

cc: @tsg @MikePaquette @dov0211 @thomasneirynck @webmat

[ruflin]

@webmat I see you you already added this to the potential ECS ingest processor. I wonder if with this potentially we could even offer some ECS dashboard.

[webmat]

@ruflin Yes, great idea! It doesn't quite fit the gist of elastic/ecs#181, so I've opened elastic/ecs#423.

[alexfrancoeur]

During the 7.0 live even @thomasneirynck did a similar demo and there were immediate questions around how to draw the line for the "pew pew" map. This specific user was hoping to see this functionality out of the box in 7.x. I thought this might be a good place to share that feedback 😄

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[botelastic]

This issue doesn't have a Team:<team> label.