Change the default mapping

Elastic Stack Elasticsearch
1

Hi,

my current mapping looks like this,

{
"threatfeedsone" : {
"mappings" : {
"IPv4" : {
"properties" : {
"@timestamp" : {
"type" : "date",
"format" : "strict_date_optional_time||epoch_millis"
},
"@version" : {
"type" : "string"
},
"direction" : {
"type" : "string"
},
"entity" : {
"type" : "string"
},
"geoip" : {
"properties" : {
"area_code" : {
"type" : "long"
},
"city_name" : {
"type" : "string"
},
"continent_code" : {
"type" : "string"
},
"country_code2" : {
"type" : "string"
},
"country_code3" : {
"type" : "string"
},
"country_name" : {
"type" : "string"
},
"dma_code" : {
"type" : "long"
},
"ip" : {
"type" : "string"
},
"latitude" : {
"type" : "double"
},
"location" : {
"type" : "double"
},
"longitude" : {
"type" : "double"
},
"postal_code" : {
"type" : "string"
},
"real_region_name" : {
"type" : "string"
},
"region_name" : {
"type" : "string"
},
"timezone" : {
"type" : "string"
}
}
},
"host" : {
"type" : "string"
},
"message" : {
"type" : "string"
},
"path" : {
"type" : "string"
},
"source" : {
"type" : "string"
},
"type" : {
"type" : "string"
}
}
}
}
}
}

Please let me know how to change the geo location to geo_point instead of double

2

First of all, you'll have to create a new index with the updated mappings and reindex your data there.

Take these mappings, edit them as necessary, and pass them as the settings of the new index when using the index creation API call or issue a subsequent mapping put call. Finally reindex your data into the new index.

3

I'd change a fair bit in that mapping, why do you have postcode as a string for eg, shouldn't that be a number?

4

I'd change a fair bit in that mapping, why do you have postcode as a string for eg, shouldn't that be a number?

Perhaps, but the postcode of many countries (e.g. UK and Sweden) include letters and/or spaces.

1 Like
5

Or worse as that usually fails silently as in the local post office later has to resolve the address manually: Leading zeros (e.g. Germany).

6

Yes, it's not that simple, there are postcodes composed of components, like routing key and unique ID and checksum, like the Eircode in Ireland :smile:

1 Like
7

Leading zeros in the US as well

1 Like
8

That is weird: I once got a package from a US based company that was missing the leading zero in my postal code. As a result I thought the US don't have this issue - but if it's the same there, I'm wondering who implemented the form I filled in back then. :wink:

9

The US has its fair share of bad web developers. Are there none were you
are? I must move there at once! :slight_smile:

Ivan

1 Like
10

Oh! Move to AU, we don't have that issue :wink: