# Coordinate Map

**URL:** <https://discuss.elastic.co/t/coordinate-map/135271>\
**Category:** Kibana\
**Created:** [June 10, 2018, 6:16pm UTC](https://discuss.elastic.co/t/coordinate-map/135271 "2018-06-10T18:16:36Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![JeMunos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jemunos/32/32664_2.png) [@JeMunos](https://discuss.elastic.co/u/JeMunos)\
**Post date:** [June 10, 2018, 6:16pm UTC](https://discuss.elastic.co/t/coordinate-map/135271/1 "2018-06-10T18:16:36Z")

</div>

I'm trying to create a coordinate map using the GeoID data. I have the data being properly enriched by logstash and I am able to see the new GeoID fields in each new record as you can see here:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/2/42345e0c33949dcca1a889a18b0128fa27f02f0a.png)

Thats great. I love the log enrichment options. So I go to visualize -\> coordinate map and set it up as seen here:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/7/c73d62cd09d961d2f34a6526d4af54677bfcc86c.jpg)

I'm not really interested in the other map versions yet. I just wanted to get it working with the basic map that is included. However regardless of which settings I try I only get the blank map, no markers ever appear.

At first I thought this might be because of the index data so I checked that out. Initially the GeoID data wasn't there. So I updated it with the refresh fields list button. All the GeoID fields appeared. However this did not change anything regarding my map.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/3/33289e68f8b2f460aa7d78c1fb9ad5ed4011417a.png)

So now I"m a bit stuck and not sure how to proceed. I have been able to make other visualizations such as bar charts using the GeoID tags. EX:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/4/946345671b4c7073b3c7ad8334e5edb07e7cdf1d.png)

Here are my logstash config files:  
input.config:  
input {  
stdin {  
}  
rabbitmq{  
host =\> "localhost"  
queue =\> "queue"  
heartbeat =\> 30  
passive =\> true  
durable =\> true  
codec =\> "json"  
}  
}  
geoip.conf  
filter {  
geoip {  
source =\> "[computer][external\_ip]"  
target =\> "[GeoIP]"  
}  
}  
output.conf:  
output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
}  
stdout {  
codec =\> rubydebug  
}  
}

Thanks in advance for any advise!

---

<div class="post-metadata">

**Author:** ![JKhondhu](https://avatars.discourse-cdn.com/v4/letter/j/ed655f/32.png) [@JKhondhu](https://discuss.elastic.co/u/JKhondhu)\
**Post date:** [June 11, 2018, 8:14am UTC](https://discuss.elastic.co/t/coordinate-map/135271/2 "2018-06-11T08:14:32Z")

</div>

Hi,  
I can see a string data type for your `GeoIP.ip`. I would imagine this needing to be of a `ip` data type. See an example of such from here [https://www.elastic.co/blog/geoip-in-the-elastic-stack](https://www.elastic.co/blog/geoip-in-the-elastic-stack) under the heading `Mapping, for Maps`.

---

<div class="post-metadata">

**Author:** ![JeMunos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jemunos/32/32664_2.png) [@JeMunos](https://discuss.elastic.co/u/JeMunos)\
**Post date:** [June 20, 2018, 10:29pm UTC](https://discuss.elastic.co/t/coordinate-map/135271/3 "2018-06-20T22:29:15Z")

</div>

So I tried to follow that guide. I'm a bit stuck though. I don't see how I am supposed to utilize the template info under Mapping, for Maps. Specificially:

```
"geoip" : {
  "dynamic": true,
  "properties" : {
    "ip": { "type": "ip" },
    "location" : { "type" : "geo_point" },
    "latitude" : { "type" : "half_float" },
    "longitude" : { "type" : "half_float" }
  }
}

```

I'm at a bit of a loss as to how to apply this. I am using logstash directly to add the GeoIP data. and that ip data type is correct set now. I even see the location data in the dictionary format within the json output of a search: EX:

```
"GeoIP": {
  "country_name": "Peru",
  "ip": "<IP>",
  "location": {
    "lat": -12.0677,
    "lon": -77.0846
  },

```

I definitely feel I am missing something obvious, just can't seem to put my finger on it as of yet.

---

<div class="post-metadata">

**Author:** ![JeMunos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jemunos/32/32664_2.png) [@JeMunos](https://discuss.elastic.co/u/JeMunos)\
**Post date:** [June 22, 2018, 10:57pm UTC](https://discuss.elastic.co/t/coordinate-map/135271/4 "2018-06-22T22:57:55Z")

</div>

I finally figured this out so I wanted to share.  
I didn't understand what the problem was until I looked at the JSON output and realized that the coordinates were coming down in a single field, only to be split up by elastic-search into multiple fields. This led me to realize that the dictionary was being parsed because it wasn't an array as well. IE {data, data1} vs [{data, data1}].  
Once I realized that I figured there was a problem with my geoIP filter that was causing it. I thought at first that I might need to mutate the data somehow. However I realized that I was setting a target it looked like this:

> filter{  
> geoip {  
> source =\> "[computer][external\_ip]"  
> target =\> "[GeoIP]"  
> }  
> }

So i decided to test and see what the result would be if I simply removed the target option  
IE:

> filter{  
> geoip {  
> source =\> "[computer][external\_ip]"  
> }  
> }

As soon as I removed the target field, it came out correctly and I was able to begin mapping.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 20, 2018, 10:58pm UTC](https://discuss.elastic.co/t/coordinate-map/135271/5 "2018-07-20T22:58:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.