# Adding Location Map to Kibana 6

**URL:** <https://discuss.elastic.co/t/adding-location-map-to-kibana-6/108880>\
**Category:** Kibana\
**Created:** [November 23, 2017, 12:04pm UTC](https://discuss.elastic.co/t/adding-location-map-to-kibana-6/108880 "2017-11-23T12:04:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![stevebeattie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stevebeattie/32/9228_2.png) [@stevebeattie](https://discuss.elastic.co/u/stevebeattie)\
**Post date:** [November 23, 2017, 12:04pm UTC](https://discuss.elastic.co/t/adding-location-map-to-kibana-6/108880/1 "2017-11-23T12:04:17Z")

</div>

Hi,  
I've installed Elastic Stack 6, it monitors a number of servers via Metricbeat and Filebeat (IHS/apache access and error logs). Everything works ok, except for setting up a coordinate map based on the IP address in the IHS/apache access logs.

I created a new mapping containing the geo\_point type, but this conflicted with my existing mapping and I ended up in a pickle this morning when logstash wouldn't index because there were two mapping types. I think that I've rectified this conflict now, but I'm back to my original problem of not having geo\_point type in my default mapping.

I'm new to Elastic Stack, but from what I've read I understand that I will have to remove existing index files - that's fine. I'm guessing that I somehow need to add the geo\_point type to the default template.

This is the snippet from my /etc/logstash/conf.d/12-apache.conf:-1:  
geoip {  
source =\> "clientip"  
target =\> "geoip"  
database =\> "/etc/logstash/GeoLite2-City\_20171107/GeoLite2-City.mmdb"  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ]  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ]  
}  
mutate {  
convert =\> ["[geoip][coordinates]", "float"]  
}

Thanks, Steve.

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [November 23, 2017, 1:17pm UTC](https://discuss.elastic.co/t/adding-location-map-to-kibana-6/108880/2 "2017-11-23T13:17:58Z")

</div>

Regarding the logstash side, the second `add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ]` will overwrite the first.

Is this your intention?

This blog post from Aaron (ex Logstash, now in Consulting) explains everything IMO. [https://www.elastic.co/blog/logstash\_lesson\_elasticsearch\_mapping](https://www.elastic.co/blog/logstash_lesson_elasticsearch_mapping)

And this setting in the Elasticsearch output might help too.  
[https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-manage\_template](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-manage_template)

---

<div class="post-metadata">

**Author:** ![stevebeattie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stevebeattie/32/9228_2.png) [@stevebeattie](https://discuss.elastic.co/u/stevebeattie)\
**Post date:** [November 24, 2017, 8:26am UTC](https://discuss.elastic.co/t/adding-location-map-to-kibana-6/108880/3 "2017-11-24T08:26:21Z")

</div>

Thanks for the info. I think that the add\_field has been a case of copying something without understanding what is was doing or if it was correct ☹

I'll have a read of the links.

Thanks, Steve.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 22, 2017, 8:26am UTC](https://discuss.elastic.co/t/adding-location-map-to-kibana-6/108880/4 "2017-12-22T08:26:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.