stephenb
September 2, 2019, 12:24am
2
Perhaps see this thread. In short you need a index template with a geo_point data type mapping typically accomplished via an index_template
Hi,
We have a problem loading geo_point data, the index template, after some tests, now is configured as:
location..........conflict
location.lat.....number
location.lon....number
So, when I try to create a map visualization there is no data.
We load the data from Logstash:
mutate {
add_field => [ "[geolocation][lat]", "%{lat}" ]
add_field => [ "[geolocation][lon]", "%{lng}" ]
convert => {
"[geolocation][lat]" => "float"
"[geolocation][lon]" => "float"
}
remove_field => [ "lat", "…
and perhaps this post
Yes use an index template see here it is exactly for this case.
It will be applied to all new indices that fit the pattern apologies I should have showed you this at first I just wasn't sure what you were trying to accomplish.
it would look something like this and every new index created with the pattern will apply this mapping
PUT _template/stats
{
"index_patterns": ["stats*"],
"settings": {
"number_of_shards": 1
},
"mappings": {
"properties": {
"location": {
"t…