# Change GEO.LOCATION to GEO\_POINT data type
**URL:** https://discuss.elastic.co/t/change-geo-location-to-geo-point-data-type/73015
**Category:** Elasticsearch
**Created:** [January 27, 2017, 1:01pm UTC](https://discuss.elastic.co/t/change-geo-location-to-geo-point-data-type/73015 "2017-01-27T13:01:19Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@mmethe](https://discuss.elastic.co/u/mmethe)
#### Post date: [January 27, 2017, 1:01pm UTC](https://discuss.elastic.co/t/change-geo-location-to-geo-point-data-type/73015/1 "2017-01-27T13:01:19Z")
All,
I am collecting syslogs from my Cisco ASA firewall. Logstash is getting info just fine. I can discover and visualize current data as expected.
I cannot get geo mapping to work and cannot find a concise, understandable to me method to change the geolocation from a number type to geo\_point. Because this field is not geo\_point I cannot create geo maps of geo data.
How do I make this field into a GEO\_POINT?
Thanks!!!
-Mike M
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [January 29, 2017, 4:12am UTC](https://discuss.elastic.co/t/change-geo-location-to-geo-point-data-type/73015/2 "2017-01-29T04:12:31Z")
You need to look at your template/mapping and make sure things are aligned.
So show what you have already (`_template` or `_mapping` endpoints) and we can go from there.
---
### Author:  [@mmethe](https://discuss.elastic.co/u/mmethe)
#### Post date: [January 30, 2017, 1:02pm UTC](https://discuss.elastic.co/t/change-geo-location-to-geo-point-data-type/73015/3 "2017-01-30T13:02:51Z")
I am unsure how to determine this but will begin educating myself now. Thanks for the tip!
I will report back.
Thanks!!!
-Mike M
---
### Author:  [@mmethe](https://discuss.elastic.co/u/mmethe)
#### Post date: [January 30, 2017, 8:36pm UTC](https://discuss.elastic.co/t/change-geo-location-to-geo-point-data-type/73015/4 "2017-01-30T20:36:10Z")
By issuing the command:
curl -XGET localhost:9200/\_template
I can see the following in the results:
"location":{"type":"geo\_point","doc\_values":true}
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [January 30, 2017, 8:53pm UTC](https://discuss.elastic.co/t/change-geo-location-to-geo-point-data-type/73015/5 "2017-01-30T20:53:22Z")
But does the index pattern of that template match your index name?
---
### Author:  [@mmethe](https://discuss.elastic.co/u/mmethe)
#### Post date: [January 30, 2017, 8:54pm UTC](https://discuss.elastic.co/t/change-geo-location-to-geo-point-data-type/73015/6 "2017-01-30T20:54:42Z")
Not sure how to tell...
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [January 30, 2017, 9:11pm UTC](https://discuss.elastic.co/t/change-geo-location-to-geo-point-data-type/73015/7 "2017-01-30T21:11:52Z")
You've seen [https://www.elastic.co/guide/en/elasticsearch/reference/5.1/indices-templates.html](https://www.elastic.co/guide/en/elasticsearch/reference/5.1/indices-templates.html)?
In the first example, this part `"template": "te*",` is a pattern that matches the index name. So an index of name `test` or `template` will all match but `today-20171231` won't.
So if you are looking at the `logstash-*` template and your index is `cisco-$DATE`, then that would explain things.
---
### Author:  [@mmethe](https://discuss.elastic.co/u/mmethe)
#### Post date: [January 31, 2017, 5:17pm UTC](https://discuss.elastic.co/t/change-geo-location-to-geo-point-data-type/73015/8 "2017-01-31T17:17:42Z")
Using Senese I see:
And further down:
My confusion is around how to:
-Apply a template at index creation time
-Modify the template
Your time and input is very appreciated.
Thanks!
-Mike M
---
### Author:  [@mmethe](https://discuss.elastic.co/u/mmethe)
#### Post date: [January 31, 2017, 6:12pm UTC](https://discuss.elastic.co/t/change-geo-location-to-geo-point-data-type/73015/9 "2017-01-31T18:12:55Z")
I made these changes based on the above. Should this logstash.conf do it? Kibana discovery is not showing any records at all for logstash-\*
```
input {
beats {
port => 5044
}
udp {
host => "127.0.0.1"
port => 10514
codec => "json"
type => "logstash"
}
beats {
port => 5045
type => "ex_msg_trk"
}
file {
path => "/var/log/remote-hosts/BRT1-VHOST1.RETREATHEALTHCARE.ORG/BRT1-VHOST1.RETREATHEALTHCARE.ORG-20170127.log"
start_position => "beginning"
}
}
filter {
if [type] == "ex_msg_trk" {
grok {
match => { "message" => "(%{TIMESTAMP_ISO8601:date-time})?,(%{IPORHOST:client-ip})?,(%{IPORHOST:client-hostname})?,(%{IPORHOST:server-ip})?,(%{IPORHOST:server-hostname})?,(%{GREEDYDATA:source-context})?,(
%{GREEDYDATA:connector-id})?,(%{WORD:source})?,(%{WORD:event-id})?,(%{NUMBER:internal-message-id})?,(%{GREEDYDATA:message-id})?,(%{GREEDYDATA:recipient-address})?,(%{GREEDYDATA:recipient-status})?,(%{NUMBER:t
otal-bytes})?,(%{NUMBER:recipient-count})?,(%{GREEDYDATA:related-recipient-address})?,(%{GREEDYDATA:reference})?,(%{GREEDYDATA:message-subject})?,(%{GREEDYDATA:sender-address})?,(%{GREEDYDATA:return-path})?,(
%{GREEDYDATA:message-info})?,(%{WORD:directionality})?,(%{GREEDYDATA:tenant-id})?,(%{IPORHOST:original-client-ip})?,(%{IPORHOST:original-server-ip})?,(%{GREEDYDATA:custom-data})?" }
}
mutate {
convert => ["total-bytes", "integer"]
convert => ["recipient-count", "integer"]
split => ["recipient-address", ";"]
split => ["source-context", ";"]
split => ["custom_data", ";"]
}
}
if [type] == "logstash" {
# Extract fields from the each of the detailed message types
# The patterns provided below are included in core of LogStash 1.4.2.
grok {
match => [
"message", "%{CISCOFW106001}",
"message", "%{CISCOFW106006_106007_106010}",
"message", "%{CISCOFW106014}",
"message", "%{CISCOFW106015}",
"message", "%{CISCOFW106021}",
"message", "%{CISCOFW106023}",
"message", "%{CISCOFW106100}",
"message", "%{CISCOFW110002}",
"message", "%{CISCOFW302010}",
"message", "%{CISCOFW302013_302014_302015_302016}",
"message", "%{CISCOFW302020_302021}",
"message", "%{CISCOFW305011}",
"message", "%{CISCOFW313001_313004_313008}",
"message", "%{CISCOFW313005}",
"message", "%{CISCOFW402117}",
"message", "%{CISCOFW402119}",
"message", "%{CISCOFW419001}",
"message", "%{CISCOFW419002}",
"message", "%{CISCOFW500004}",
"message", "%{CISCOFW602303_602304}",
"message", "%{CISCOFW710001_710002_710003_710005_710006}",
"message", "%{CISCOFW713172}",
"message", "%{CISCOFW733100}"
]
}
# Parse the syslog severity and facility
syslog_pri { }
# Do a DNS lookup for the sending host
# Otherwise host field will contain an
# IP address instead of a hostname
dns {
reverse => ["host"]
action => "replace"
}
geoip {
source => "src_ip"
target => "geoip"
database => "/opt/logstash/databases/GeoLiteCity.dat"
add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
}
mutate {
convert => ["[geoip][coordinates]", "float"]
}
# do GeoIP lookup for the ASN/ISP information.
geoip {
database => "/opt/logstash/databases/GeoIPASNum.dat"
source => "src_ip"
}
}
if [path] =~ "VHOST" {
mutate { replace => {"type" => "esxi_host"}}
}
}
output {
if [type] == "logstash" {
elasticsearch {
hosts => ["127.0.0.1:9200"]
index => "%{type}-%{+YYYY.MM.dd}"
manage_template => false
document_type => "logstash"
}
}
if [type] == "ex_msg_trk" {
elasticsearch {
hosts => ["127.0.0.1:9200"]
index => "logstash_exch-%{+YYYY.MM.dd}"
}
}
if [type] == "esxi_host" {
elasticsearch {
hosts => ["127.0.0.1:9200"]
index => "%{type}-%{+YYYY.MM.dd}"
}
} else {
elasticsearch {
hosts => ["localhost:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
}
```
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [January 31, 2017, 8:10pm UTC](https://discuss.elastic.co/t/change-geo-location-to-geo-point-data-type/73015/10 "2017-01-31T20:10:10Z")
It'll help if you can edit that and wrap the config in code formatting - `` button.
---
### Author:  [@mmethe](https://discuss.elastic.co/u/mmethe)
#### Post date: [January 31, 2017, 8:13pm UTC](https://discuss.elastic.co/t/change-geo-location-to-geo-point-data-type/73015/11 "2017-01-31T20:13:22Z")
Done, thanks for the tip
---
### Author:  [@mmethe](https://discuss.elastic.co/u/mmethe)
#### Post date: [February 2, 2017, 7:01pm UTC](https://discuss.elastic.co/t/change-geo-location-to-geo-point-data-type/73015/12 "2017-02-02T19:01:31Z")
Debug tells me this at the end of the 400 error:
"type"=\>"parse\_exception", "reason"=\>"geo\_point expected"
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 2, 2017, 7:23pm UTC](https://discuss.elastic.co/t/change-geo-location-to-geo-point-data-type/73015/13 "2017-02-02T19:23:14Z")
> [@mmethe](#):
>
> add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
> add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
> }
> mutate {
> convert =\> ["[geoip][coordinates]", "float"]
> }
You shouldn't need that, it does it by default.
---
### Author:  [@mmethe](https://discuss.elastic.co/u/mmethe)
#### Post date: [February 2, 2017, 7:34pm UTC](https://discuss.elastic.co/t/change-geo-location-to-geo-point-data-type/73015/14 "2017-02-02T19:34:59Z")
Removed indicated lines
Is it a mapping issue? not sure how to fax that...
{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse", "caused\_by"=\>{"type"=\>"parse\_exception", "reason"=\>"geo\_point expected"}}}}, :level=\>:warn, :file=\>"logstash/outputs/elasticsearch/common.rb", :line=\>"119", :method=\>"submit"}
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 2, 2017, 7:48pm UTC](https://discuss.elastic.co/t/change-geo-location-to-geo-point-data-type/73015/15 "2017-02-02T19:48:36Z")
Which index is this going into? Does it have a matching template?
---
### Author:  [@mmethe](https://discuss.elastic.co/u/mmethe)
#### Post date: [February 2, 2017, 8:05pm UTC](https://discuss.elastic.co/t/change-geo-location-to-geo-point-data-type/73015/16 "2017-02-02T20:05:03Z")
Based on the output it goes to logstashit-\* correct?
elasticsearch {
hosts =\> ["127.0.0.1:9200"]
index =\> "logstashit-%{+YYYY.MM.dd}"
manage\_template =\> true
template\_name =\> "logstash\*"
# document\_type =\> "logstash"
}
I am not sure how to create the associated template. I could send it to logstash-\*
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 3, 2017, 1:44am UTC](https://discuss.elastic.co/t/change-geo-location-to-geo-point-data-type/73015/17 "2017-02-03T01:44:34Z")
Unless you have a matching template it won't match the default `logstash-*` one. So you may want to copy the existing one and give it that pattern.
Also, that index naming pattern can be easily misread 😛
---
### Author:  [@mmethe](https://discuss.elastic.co/u/mmethe)
#### Post date: [February 3, 2017, 12:50pm UTC](https://discuss.elastic.co/t/change-geo-location-to-geo-point-data-type/73015/18 "2017-02-03T12:50:39Z")
So if I send it to index logstash-\*, it would match correct?
---
### Author:  [@mmethe](https://discuss.elastic.co/u/mmethe)
#### Post date: [February 3, 2017, 1:14pm UTC](https://discuss.elastic.co/t/change-geo-location-to-geo-point-data-type/73015/19 "2017-02-03T13:14:51Z")
I have this now and getting the error below the code
```
output {
elasticsearch {
hosts => ["127.0.0.1:9200"]
index => "logstash-%{+YYYY.MM.dd}"
manage_template => true
template_name => "logstash*"
# document_type => "logstash"
}
}
```
Error Text:
`"error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [geoip.latitude] of different type, current_type [double], merged_type [float]"}}}, :level=>:warn, :file=>"logstash/outputs/elasticsearch/common.rb", :line=>"119", :method=>"submit"}`
---
### Author:  [@mmethe](https://discuss.elastic.co/u/mmethe)
#### Post date: [February 3, 2017, 2:15pm UTC](https://discuss.elastic.co/t/change-geo-location-to-geo-point-data-type/73015/20 "2017-02-03T14:15:54Z")
WooHooo! Its working.
Created a new index and template.
Thanks for leading me down the path. Was a good educational process
[Next page](https://discuss.elastic.co/t/change-geo-location-to-geo-point-data-type/73015.md?page=2)