# Add Geopoint based off of parsed value to logstash config
**URL:** https://discuss.elastic.co/t/add-geopoint-based-off-of-parsed-value-to-logstash-config/26580
**Category:** Logstash
**Created:** [July 30, 2015, 3:55pm UTC](https://discuss.elastic.co/t/add-geopoint-based-off-of-parsed-value-to-logstash-config/26580 "2015-07-30T15:55:41Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@russK](https://discuss.elastic.co/u/russK)
#### Post date: [July 30, 2015, 3:55pm UTC](https://discuss.elastic.co/t/add-geopoint-based-off-of-parsed-value-to-logstash-config/26580/1 "2015-07-30T15:55:41Z")
Hello,
Part of my matched message returns the fields
%{NUMBER:XCent} %{NUMBER:YCent}
which are lat, long points.
I'm attempting to add a location pin but keep getting a config failure when i use the --debug flag on my configuration file apparently it's expecting a # symbol???
```
if [XCent] and [YCent] {
"location" : {
"lat" : %{XCent},
"lon" : %{YCent},
"type" : "geo_point"
}
}
```
Any suggestions? Much thanks!
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 30, 2015, 6:14pm UTC](https://discuss.elastic.co/t/add-geopoint-based-off-of-parsed-value-to-logstash-config/26580/2 "2015-07-30T18:14:14Z")
Is that what's in your configuration file? Because it barely resembles Logstash's configuration file syntax. You need something like this:
```
filter {
if [XCent] and [YCent] {
mutate {
add_field => {
"[location][lat]" => "%{XCent}"
"[location][lon]" => "%{YCent}"
}
}
mutate {
convert => {
"[location][lat]" => "float"
"[location][lon]" => "float"
}
}
}
}
```
---
### Author:  [@russK](https://discuss.elastic.co/u/russK)
#### Post date: [July 30, 2015, 6:48pm UTC](https://discuss.elastic.co/t/add-geopoint-based-off-of-parsed-value-to-logstash-config/26580/3 "2015-07-30T18:48:41Z")
Sorry for the confusion, that was only an excerpt from my logstash configuration file.
Your suggestion passes the debug flag, but the location points still don't show up in the tile map. Can I change the second conversion to:
```
convert => {
"[location][lat]" => "float"
"[location][lon]" => "float"
"[location]" => "geo_point"
}
```
Or is there a different recommended way to drop the pin of the location into a format that the tile map can pick up?
Again thank you for the assistance thus far!
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 30, 2015, 6:53pm UTC](https://discuss.elastic.co/t/add-geopoint-based-off-of-parsed-value-to-logstash-config/26580/4 "2015-07-30T18:53:33Z")
The mutate filter can only change between different JSON types and "geo\_point" is an ES concept. To have a field mapped as geo\_point I think you need to modify the mapping.
(For testing configurations you want the `--configtest` option, not `--debug`. Well, the latter will implicitly test the configuration upon startup but so will running Logstash without any such options.)
---
### Author:  [@russK](https://discuss.elastic.co/u/russK)
#### Post date: [July 31, 2015, 3:34pm UTC](https://discuss.elastic.co/t/add-geopoint-based-off-of-parsed-value-to-logstash-config/26580/5 "2015-07-31T15:34:32Z")
I've looked at the gioip filter rb files, and the elasticsearch.yml file. I'm not sure where I apply the mapping for the location field to cast it as a geo point. I also tried to use the geoip plugin and override the values as a work around, but it's just not coming together easily.
Thanks for the suggestion of the --configtest flag, it's made debugging a lot quicker!
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 31, 2015, 6:04pm UTC](https://discuss.elastic.co/t/add-geopoint-based-off-of-parsed-value-to-logstash-config/26580/6 "2015-07-31T18:04:33Z")
Have a look at index templates. Logstash manages the index template for logstash-\* indexes by default but you can override it and supply your own template (based on the Logstash default). In that template you can specify that your location field has the geo\_point type.
---
### Author:  [@russK](https://discuss.elastic.co/u/russK)
#### Post date: [July 31, 2015, 10:35pm UTC](https://discuss.elastic.co/t/add-geopoint-based-off-of-parsed-value-to-logstash-config/26580/7 "2015-07-31T22:35:03Z")
My apologies I'm still very confused by this matter.
I've reviewed both of the guides by elastic.
[https://www.elastic.co/guide/en/elasticsearch/reference/1.5/indices-templates.html](https://www.elastic.co/guide/en/elasticsearch/reference/1.5/indices-templates.html)
[https://www.elastic.co/guide/en/elasticsearch/guide/current/custom-dynamic-mapping.html](https://www.elastic.co/guide/en/elasticsearch/guide/current/custom-dynamic-mapping.html)
As well as this stack overflow post
>
I guess I'm just not sure where to save the new template. Again thanks for all the knowledge.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 1, 2015, 7:25am UTC](https://discuss.elastic.co/t/add-geopoint-based-off-of-parsed-value-to-logstash-config/26580/8 "2015-08-01T07:25:18Z")
Eventually the template is saved in the cluster itself, but you'll typically have a version-controlled source file somewhere (i.e. anywhere).
The simplest way is to make a copy of Logstash's template file (the exact path varies but IIRC the filename is elasticsearch-template.json) and point the [`template`](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-template) option of the elasticsearch output to it. Then modify the template to your needs, i.e. by adding a geo\_point-typed field. When Logstash creates the next index after the configuration change (typically tomorrow's index) that index should have the correct mapping.
Another option is to disable Logstash's index template handling altogether with the [`manage_template`](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-manage_template) option and post your tempate into the cluster on your own. That's what I prefer, but YMMV.
---
### Author:  [@russK](https://discuss.elastic.co/u/russK)
#### Post date: [August 3, 2015, 11:26pm UTC](https://discuss.elastic.co/t/add-geopoint-based-off-of-parsed-value-to-logstash-config/26580/9 "2015-08-03T23:26:33Z")
Thank you! That's exactly what I had been missing 🙂
---
### Author:  [@spraveenjd](https://discuss.elastic.co/u/spraveenjd)
#### Post date: [July 8, 2016, 8:23pm UTC](https://discuss.elastic.co/t/add-geopoint-based-off-of-parsed-value-to-logstash-config/26580/10 "2016-07-08T20:23:03Z")
I am using elasticsearch 2.3.3 and logstash-2.3.1. What is the best way to create the geo\_point
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 9, 2016, 2:38pm UTC](https://discuss.elastic.co/t/add-geopoint-based-off-of-parsed-value-to-logstash-config/26580/11 "2016-07-09T14:38:39Z")
@spraveenjd, please start a new thread for your question, and when you do please ask a more specific question that includes information about what information you want to turn into a geo\_point (an example event as produced by a `stdout { codec => rubydebug }` would be great) and your current configuration.
---
### Author:  [@daniloambrosini](https://discuss.elastic.co/u/daniloambrosini)
#### Post date: [June 13, 2017, 12:55pm UTC](https://discuss.elastic.co/t/add-geopoint-based-off-of-parsed-value-to-logstash-config/26580/12 "2017-06-13T12:55:20Z")
Hi,
Also i have difficulty setting the type to geo\_point for the geoip.location field, this is my .conf you have tips ??
```
if [FRAZ_IP] =~ /.+/ {
geoip {
source => "FRAZ_IP"
target => "geoip"
fields => ["city_name", "latitude", "longitude", "location","ip"]
database => "/home/elkadmin/geoip/geo_ip_poste.mmdb"
}
mutate {
add_field => ["[geoip][location]","%{longitude}"]
add_field => ["[geoip][location]","%{latitude}"]
}
mutate {
convert => ["[geoip][location]", "float" ]
}
}
```
}
this is my pattern index after the import logs
---
### Author:  [@pravinnair](https://discuss.elastic.co/u/pravinnair)
#### Post date: [December 16, 2018, 9:56pm UTC](https://discuss.elastic.co/t/add-geopoint-based-off-of-parsed-value-to-logstash-config/26580/13 "2018-12-16T21:56:04Z")
> [@magnusbaeck](#):
>
> codec =\> rubydebug
I have followed this post, and still not able to convert the location to geo\_point,
I have created another post details
https://discuss.elastic.co/t/location-to-geo-point-mapping-not-working-with-logtash-and-kibana/160980/3
I am using manage\_template and have my own template with location as type geo\_point
---
### Author:  [@brunorcabral](https://discuss.elastic.co/u/brunorcabral)
#### Post date: [January 5, 2021, 9:03pm UTC](https://discuss.elastic.co/t/add-geopoint-based-off-of-parsed-value-to-logstash-config/26580/14 "2021-01-05T21:03:45Z")
I solved my issue by using this solution
>
```auto
filter{
mutate {
add_field => {
"[location][type]" => "point"
}
}
ruby{
code => '
event.set("[location][coordinates]", [event.get("latitude"), event.get("longitude")])
'
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 4, 2022, 4:03am UTC](https://discuss.elastic.co/t/add-geopoint-based-off-of-parsed-value-to-logstash-config/26580/15 "2022-11-04T04:03:36Z")