# ASA MAP geo\_point **URL:** \ **Category:** Elasticsearch\ **Created:** [January 23, 2017, 12:39am UTC](https://discuss.elastic.co/t/asa-map-geo-point/72419 "2017-01-23T00:39:52Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![mmethe](https://avatars.discourse-cdn.com/v4/letter/m/e68b1a/32.png) [@mmethe](https://discuss.elastic.co/u/mmethe)\ **Post date:** [January 23, 2017, 12:39am UTC](https://discuss.elastic.co/t/asa-map-geo-point/72419/1 "2017-01-23T00:39:52Z")
I am trying to create a tile map of a cisco-fw index. **This is the error:** ![](https://us1.discourse-cdn.com/elastic/original/2X/2/2a2dda6afdd3e39e84abce92581134b96146f453.png) **This are the fields I can see (I think)** ![](https://us1.discourse-cdn.com/elastic/original/2X/1/1c23e69b2dd288ab639063ea5b1703f7382c1a56.png) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 23, 2017, 2:02am UTC](https://discuss.elastic.co/t/asa-map-geo-point/72419/2 "2017-01-23T02:02:19Z")
How are the field mapped ---
**Author:** ![mmethe](https://avatars.discourse-cdn.com/v4/letter/m/e68b1a/32.png) [@mmethe](https://discuss.elastic.co/u/mmethe)\ **Post date:** [January 23, 2017, 12:36pm UTC](https://discuss.elastic.co/t/asa-map-geo-point/72419/3 "2017-01-23T12:36:17Z")
Thanks for the reply. I am not sure how to determine that. Kind of new. I guess I would need to determine: 1. does the field exist 2. is the coordinate field mapped to the correct field Am I on the right track? Any guidance on determining these items? Thanks ---
**Author:** ![mmethe](https://avatars.discourse-cdn.com/v4/letter/m/e68b1a/32.png) [@mmethe](https://discuss.elastic.co/u/mmethe)\ **Post date:** [January 23, 2017, 5:08pm UTC](https://discuss.elastic.co/t/asa-map-geo-point/72419/4 "2017-01-23T17:08:30Z")
Would this work going forward? copy elasticsearch-template.json alter "template" : "logstash-_" to "template" : "cisco-fw_" If geo\_point is as following in this template "geo\_point\_fields" : { "match" : "\*", "match\_mapping\_type" : "geo\_point", "mapping" : { "type" : "geo\_point", "doc\_values" : true } Will all future daily indexes created by cisco-fw have geo\_point? ---
**Author:** ![mmethe](https://avatars.discourse-cdn.com/v4/letter/m/e68b1a/32.png) [@mmethe](https://discuss.elastic.co/u/mmethe)\ **Post date:** [January 25, 2017, 3:26pm UTC](https://discuss.elastic.co/t/asa-map-geo-point/72419/5 "2017-01-25T15:26:02Z")
Any ideas on getting this working? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 25, 2017, 8:52pm UTC](https://discuss.elastic.co/t/asa-map-geo-point/72419/6 "2017-01-25T20:52:26Z")
That looks good to me! ---
**Author:** ![mmethe](https://avatars.discourse-cdn.com/v4/letter/m/e68b1a/32.png) [@mmethe](https://discuss.elastic.co/u/mmethe)\ **Post date:** [January 26, 2017, 1:29pm UTC](https://discuss.elastic.co/t/asa-map-geo-point/72419/7 "2017-01-26T13:29:02Z")
Thanks for the feed back. I can see this in the discovery ![](https://us1.discourse-cdn.com/elastic/original/2X/e/ecedfbeae2c4777d19c968b2cf4215d240ba6f08.png) Then this when I try to map based on a saved search ![](https://us1.discourse-cdn.com/elastic/original/2X/c/cbd7a446c46339fc2bca33df428fe3d2cd6000c1.png) ---
**Author:** ![mmethe](https://avatars.discourse-cdn.com/v4/letter/m/e68b1a/32.png) [@mmethe](https://discuss.elastic.co/u/mmethe)\ **Post date:** [January 26, 2017, 2:25pm UTC](https://discuss.elastic.co/t/asa-map-geo-point/72419/8 "2017-01-26T14:25:25Z")
How can I determine from what template a daily index was created? ---
**Author:** ![mmethe](https://avatars.discourse-cdn.com/v4/letter/m/e68b1a/32.png) [@mmethe](https://discuss.elastic.co/u/mmethe)\ **Post date:** [January 26, 2017, 6:28pm UTC](https://discuss.elastic.co/t/asa-map-geo-point/72419/9 "2017-01-26T18:28:15Z")
Attempted a reindex. Nothing I will summarize: Output: output { if [type] == "cisco-fw" { elasticsearch { hosts =\> ["127.0.0.1:9200"] index =\> "%{type}-%{+YYYY.MM.dd}" manage\_template =\> true document\_type =\> "cisco-fw" } } else { elasticsearch { hosts =\> ["localhost:9200"] sniffing =\> true manage\_template =\> false index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}" document\_type =\> "%{[@metadata][type]}" } } } My understanding is that the document\_type will tell elasticsearch what template to use. There are 2 templates at: /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.5.5-java/lib/logstash/outputs/elasticsearch [root@brt1-log01 elasticsearch]# ls -l total 52 -rw-r--r-- 1 logstash logstash 3385 Apr 7 2016 buffer.rb -rw-r--r-- 1 logstash logstash 9427 Apr 7 2016 common\_configs.rb -rw-r--r-- 1 logstash logstash 6614 Apr 7 2016 common.rb -rw-r--r-- 1 logstash logstash 2957 Jan 24 09:14 elasticsearch\_tempalte\_cisco.json -rw-r--r-- 1 logstash logstash 2957 Apr 7 2016 elasticsearch-template.json -rw-r--r-- 1 logstash logstash 3880 Apr 7 2016 http\_client\_builder.rb -rw-r--r-- 1 logstash logstash 8716 Apr 7 2016 http\_client.rb -rw-r--r-- 1 logstash logstash 1356 Apr 7 2016 template\_manager.rb Each has the section: "properties" : { "@timestamp": { "type": "date", "doc\_values" : true }, "@version": { "type": "string", "index": "not\_analyzed", "doc\_values" : true }, "geoip" : { "type" : "object", "dynamic": true, "properties" : { "ip": { "type": "ip", "doc\_values" : true }, "location" : { "type" : "geo\_point", "doc\_values" : true }, "latitude" : { "type" : "float", "doc\_values" : true }, "longitude" : { "type" : "float", "doc\_values" : true } My understanding is that this create the type geo\_point needed for geo mapping. What am I missing? ---
**Author:** ![mmethe](https://avatars.discourse-cdn.com/v4/letter/m/e68b1a/32.png) [@mmethe](https://discuss.elastic.co/u/mmethe)\ **Post date:** [January 26, 2017, 6:36pm UTC](https://discuss.elastic.co/t/asa-map-geo-point/72419/10 "2017-01-26T18:36:46Z")
hmmmm curl -XGET '[http://localhost:9200/\_template/cisco-fw?pretty](http://localhost:9200/_template/cisco-fw?pretty)' returns { } Nothing. ---
**Author:** ![mmethe](https://avatars.discourse-cdn.com/v4/letter/m/e68b1a/32.png) [@mmethe](https://discuss.elastic.co/u/mmethe)\ **Post date:** [January 26, 2017, 7:06pm UTC](https://discuss.elastic.co/t/asa-map-geo-point/72419/11 "2017-01-26T19:06:49Z")
Anyone know why the above happens? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 23, 2017, 7:06pm UTC](https://discuss.elastic.co/t/asa-map-geo-point/72419/12 "2017-02-23T19:06:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.