Change the type from float to geo_point

Elastic Stack Elasticsearch
1

I did a fresh installation of ES and I noticed that the geo stuff didnt work by default. The old (working) mappings are as follow: (have removed few irrelevant stuff)

curl '192.168.0.11:9200/filebeat-1/_mapping?pretty'
{
"filebeat-1" : {
"mappings" : {
"apache" : {
"_all" : {
"enabled" : true,
"norms" : false
},
"dynamic_templates" : [
{
"template1" : {
"match" : "*",
"mapping" : {
"doc_values" : true,
"ignore_above" : 1024,
"index" : "not_analyzed",
"type" : "{dynamic_type}"
}
}
}
],
"geoip" : {
"dynamic" : "true",
"properties" : {
"city_name" : {
"type" : "keyword",
"ignore_above" : 1024
},
"continent_code" : {
"type" : "keyword",
"ignore_above" : 1024
},
"country_code2" : {
"type" : "keyword",
"ignore_above" : 1024
"country_name" : {
"type" : "keyword",
"ignore_above" : 1024
},
"dma_code" : {
"type" : "long"
},
"ip" : {
"type" : "keyword",
"ignore_above" : 1024
},
"latitude" : {
"type" : "float"
},
"location" : {
"type" : "geo_point"
},
"longitude" : {
"type" : "float"
},
"postal_code" : {
"type" : "keyword",
"ignore_above" : 1024
},
"region_code" : {
"type" : "keyword",
"ignore_above" : 1024
},
"region_name" : {
"type" : "keyword",
"ignore_above" : 1024
},
"timezone" : {
"type" : "keyword",
"ignore_above" : 1024
}
}
},
"geoip" : {
"dynamic" : "true",
"properties" : {
"location" : {
"type" : "geo_point"
}
}
},
"message" : {
"type" : "text"
},
"offset" : {
"type" : "long"
}
}
}
}
}
}

My fresh new ES mapping looks like:

       "geoip" : {
            "properties" : {
              "city_name" : {
                "type" : "text",
                "fields" : {
                  "keyword" : {
                    "type" : "keyword",
                    "ignore_above" : 256
                  }
                }
              },
              "country_name" : {
                "type" : "text",
                "fields" : {
                  "keyword" : {
                    "type" : "keyword",
                    "ignore_above" : 256
                  }
                }
              },
              "dma_code" : {
                "type" : "long"
              },
              "ip" : {
                "type" : "text",
                "fields" : {
                  "keyword" : {
                    "type" : "keyword",
                    "ignore_above" : 256
                  }
                }
              },
              "latitude" : {
                "type" : "float"
              },
              **"location" : {**
              **"type" : "float"**
              },
              "longitude" : {
                "type" : "float"
              },
              "postal_code" : {
                "type" : "text",
                "fields" : {
                  "keyword" : {
                    "type" : "keyword",
                    "ignore_above" : 256
                  }
                }
              },

Kibana pinpoints that the geo_point is not indexed so I assume I have to change the location type to geo_point in order to make it work ?

How I can import the old mappings to the new instance through curl or something else more convenient or how I can just change the type of that field ? I believe this should be enough to resolve the issue!

2

Hey,

you can use the Get Mapping API and the Put Mapping API to configure mappings. This needs to be done however before data is indexed. So in your case it might make sense to use the reindex API to reindex your data into an index that has the proper mapping applied.

--Alex

3

Hi Alex

Thanks for your response.

I have read this webpage however I want something that it will affect all the indices afterwards. Is it just * ? Like

curl -XPUT 'localhost:9200/myindexes*?pretty' -d'
{
"mappings": {
"myindexes*": {
"properties": {
"message": {
"type": "text"
}
}
}
}
}'

Is the 'myindexes*' correct?

4

Hey,

again, this needs to be done before data is indexed. You cannot change the type of a field after data has been indexed, because the field defines the way data is written to disk and queried.

--Alex

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.