# AWS Version of Elasticsearch, issue with GeoIP with Lambda Function

**URL:** https://discuss.elastic.co/t/aws-version-of-elasticsearch-issue-with-geoip-with-lambda-function/89241
**Category:** Elasticsearch
**Created:** [June 13, 2017, 4:38pm UTC](https://discuss.elastic.co/t/aws-version-of-elasticsearch-issue-with-geoip-with-lambda-function/89241 "2017-06-13T16:38:36Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![wali\_raheem](https://avatars.discourse-cdn.com/v4/letter/w/6f9a4e/32.png) [@wali\_raheem](https://discuss.elastic.co/u/wali_raheem)
#### Post date: [June 13, 2017, 4:38pm UTC](https://discuss.elastic.co/t/aws-version-of-elasticsearch-issue-with-geoip-with-lambda-function/89241/1 "2017-06-13T16:38:36Z")

</div>

Hi All,

I'm _very_ new to Elasticsearch and I'm trying to get it to load some data from our AWS application load balancer with some geoip data. Well to be precise, I haven't even gotten to the Lambda converting the ip to coordinates part yet, because I having issues with mapping a coordinates field in Elasticsearch. I've created a mapping template that will treat a 'coordinates' filed as a geo\_point type which it shows in Kibana, but I get an error that says that:

```
"error": {
        "type": "mapper_parsing_exception",
        "reason": "failed to parse",
        "caused_by": {
            "type": "parse_exception",
            "reason": "geo_point expected"
        }
    } 

```

Here is my mapping:

```
{
"cwl-2017.06.13": {
"mappings": {
  "coordinates": {
    "properties": {
      "coordinates": {
        "type": "geo_point"
      },
      "type": {
        "type": "text"
      }
    }
  }
}
}

```

Here is an example of the data I'm sending to Elasticsearch (I've removed data for brevity and identifying):

```
{
 "index": {
    "_index": "cwl-2017.06.13",
    "_type": "application-load-balancer-logs-1",
    "_id": "3339237098236054586560913755308454237516464130"
 }
}

{
 "received_bytes": 152,
 "target_group_arn": "arn:aws:...5f1e",
 "request": "GET http://www.example.com:80/ HTTP/1.1",
 "trace_id": "Root=1-593ffcc5-568e2ac6d7e052",
 "@id": "333923709862434308454237516464130",
 "@timestamp": "2017-06-13T14:55:01.862Z",
 "@log_group": "application-load-balancer-logs-1",
 "@log_stream": "application-load-balancer-stream",
 "coordinates": [
    34,
    -82
 ]
}

```

I have tried that hardcoding that coordinates part a million different ways and have been banging my head on my desk trying to get this going, please any help you can provide I would greatly appreciate...

Thanks!!!

---

<div class="post-metadata">

### Author: ![wali\_raheem](https://avatars.discourse-cdn.com/v4/letter/w/6f9a4e/32.png) [@wali\_raheem](https://discuss.elastic.co/u/wali_raheem)
#### Post date: [June 13, 2017, 9:23pm UTC](https://discuss.elastic.co/t/aws-version-of-elasticsearch-issue-with-geoip-with-lambda-function/89241/2 "2017-06-13T21:23:31Z")

</div>

I seemed to have figured this out with the help of the blog post here:  
[https://jackhanington.com/blog/2014/12/11/create-a-custom-elasticsearch-template/](https://jackhanington.com/blog/2014/12/11/create-a-custom-elasticsearch-template/)

I changed my template to this:

```
{
 "template" : "cwl*",
"mappings" : {
  "application-load-balancer-logs-1" : {
     "properties": {
        "geoip":{
           "properties":{
              "ip":{"type":"ip"},
              "latitude":{"type":"double"},
              "location":{"type":"geo_point"},
              "longitude":{"type":"double"}
              }
        }
  }
}
}
}

```

Hopefully this helps someone else!

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [June 13, 2017, 11:43pm UTC](https://discuss.elastic.co/t/aws-version-of-elasticsearch-issue-with-geoip-with-lambda-function/89241/3 "2017-06-13T23:43:35Z")

</div>

[https://www.elastic.co/blog/geoip-in-the-elastic-stack](https://www.elastic.co/blog/geoip-in-the-elastic-stack) may also be useful.

---

<div class="post-metadata">

### Author: ![wali\_raheem](https://avatars.discourse-cdn.com/v4/letter/w/6f9a4e/32.png) [@wali\_raheem](https://discuss.elastic.co/u/wali_raheem)
#### Post date: [June 14, 2017, 4:03pm UTC](https://discuss.elastic.co/t/aws-version-of-elasticsearch-issue-with-geoip-with-lambda-function/89241/4 "2017-06-14T16:03:42Z")

</div>

This is good, thank you!!

As a final point to this; anyone using AWS Elasticsearch who are interested in using the tile map functionality please note:

**Using Elasticsearch with Kibana from AWS violates a term of service in regards to using the maps; so when you try it map will be blank and in the console the tiles images are pointed to [example.com/path/to/image.png](http://example.com/path/to/image.png). Even though you can change the map service provider in the options in Kibana, as of now it will still show as [example.com](http://example.com) and will result in blank map tiles**

> [@Kibana tile map not loading (trying to load from example.com)](https://discuss.elastic.co/t/kibana-tile-map-not-loading-trying-to-load-from-example-com/75242/8):
>
> They aren't allowed to use our tilemap service, per the [terms of service](https://www.elastic.co/elastic-tile-service). Who May Use Elastic Tile Service? Only users of unmodified Kibana binaries obtained directly by Elastic or an authorized distribution point (e.g., downloads and GitHub) are allowed to use the Elastic Tile Service. The version of Kibana they run on their hosted service is modified.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 12, 2017, 4:03pm UTC](https://discuss.elastic.co/t/aws-version-of-elasticsearch-issue-with-geoip-with-lambda-function/89241/5 "2017-07-12T16:03:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
