anchor.diff:      },
       {
         "geoip": {
  -        "field": "client.ip"
  +        "field": "source.ip",
  +        "target_field": "source.geo"
         }
       },
       {
  
positive.code: 
  The logs you want to parse look similar to this:
  
  [source,js]
  ----
  212.87.37.154 - - [30/May/2099:16:21:15 +0000] \"GET /favicon.ico HTTP/1.1\"
  200 3638 \"-\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6)
  
negative.code:       }
      }
    ]
  // end::common-log-pipeline[]
  }
  ----
  ////
  --
  
  . To test the pipeline, click **Add documents**.
  
  