Change GEO.LOCATION to GEO_POINT data type

You've seen https://www.elastic.co/guide/en/elasticsearch/reference/5.1/indices-templates.html?

In the first example, this part "template": "te*", is a pattern that matches the index name. So an index of name test or template will all match but today-20171231 won't.

So if you are looking at the logstash-* template and your index is cisco-$DATE, then that would explain things.