# Could not locate that index-pattern-field (id: geoip.location) **URL:** \ **Category:** Logstash\ **Created:** [March 25, 2018, 6:21pm UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-geoip-location/125501 "2018-03-25T18:21:37Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![hispeed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hispeed/32/16232_2.png) [@hispeed](https://discuss.elastic.co/u/hispeed)\ **Post date:** [March 25, 2018, 6:21pm UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-geoip-location/125501/1 "2018-03-25T18:21:37Z")
Hi, Since I updated to Version: 6.1.1 (Logstash, Elasticsearch, Kibana) I recieve the following error. I searched today and read a few things about that. I have the following lines in: 11-pfsense.conf ``` geoip { add_tag => ["GeoIP"] source => "src_ip" # Optional GeoIP database # Comment out the below if you do not wise to utilize and omit last three steps dealing with (recommended) suffix database => "/etc/logstash/GeoLite2-City.mmdb" } ``` I recieve this output in Kibana: ``` { "_index": "logstash-2018.03.25", "_type": "doc", "_id": "0iNfXmIB3glQha35s4iQ", "_version": 1, "_score": null, "_source": { "@timestamp": "2018-03-25T18:15:52.000Z", "reason": "match", "dest_ip": "192.168.0.20", "action": "pass", "id": "48297", "ip_ver": "4", "host": "192.168.0.1", "proto_id": "6", "ttl": "55", "tags": [ "PFSense", "firewall", "GeoIP" ], "type": "syslog", "dest_port": "XX881", "evtid": "134", "prog": "filterlog", "length": "60", "geoip": { "location": { "lon": 2.3387000000000002, "lat": 48.8582 }, "timezone": "Europe/Paris", "ip": "62.210.209.49", "country_name": "France", "continent_code": "EU", "country_code3": "FR", "latitude": 48.8582, "longitude": 2.3387000000000002, "country_code2": "FR" }, "tracker": "1459961264", "proto": "tcp", "message": "93,,,1459961264,em0,match,pass,in,4,0x0,,55,48297,0,DF,6,tcp,60,XX.210.209.49,192.168.0.20,XX876,16881,0,S,74249952,,29200,,mss;sackOK;TS;nop;wscale", "@version": "1", "rule": "93", "src_ip": "XX.210.209.49", "src_port": "XX876", "data_length": "0", "iface": "em0", "tos": "0x0", "direction": "in", "flags": "DF", "offset": "0" }, "fields": { "@timestamp": [ "2018-03-25T18:15:52.000Z" ] }, "sort": [ 1522001752000 ] } ``` Why I recieve geopi.location error in the Heatmap. I don't have a field in the index which is named geopip.location. How can I create that? ---
**Author:** ![hispeed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hispeed/32/16232_2.png) [@hispeed](https://discuss.elastic.co/u/hispeed)\ **Post date:** [March 28, 2018, 7:23am UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-geoip-location/125501/2 "2018-03-28T07:23:25Z")
Nobody any idea? I would appreciate every idea which could help. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 28, 2018, 8:24am UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-geoip-location/125501/3 "2018-03-28T08:24:24Z")
What does you mapping for that index look like? Do you perhaps have an error in an index template or mapping for an older index? ---
**Author:** ![hispeed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hispeed/32/16232_2.png) [@hispeed](https://discuss.elastic.co/u/hispeed)\ **Post date:** [March 28, 2018, 1:50pm UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-geoip-location/125501/4 "2018-03-28T13:50:09Z")
Hi Christian, Thanks for your reply. I have already deleted all old indices. It's not a problem because it's just for me at home. Here is my index from yesterday. I hope this helps you. I also have other index (winlogbeat) but this one shouldn't be the problem. All of the information I need are from Logstash indexes. I had to use pastebin because it's very long. [https://pastebin.com/fYeQFeKt](https://pastebin.com/fYeQFeKt) ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 28, 2018, 1:56pm UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-geoip-location/125501/5 "2018-03-28T13:56:45Z")
Your mapping for the `geoip.location` field is incorrect. You need to specify this through an [index template](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/indices-templates.html) as this can not be identified through dynamic mapping. Look at the [default Logstash template](https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/master/lib/logstash/outputs/elasticsearch/elasticsearch-template-es6x.json) as an example. ---
**Author:** ![hispeed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hispeed/32/16232_2.png) [@hispeed](https://discuss.elastic.co/u/hispeed)\ **Post date:** [March 28, 2018, 4:21pm UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-geoip-location/125501/6 "2018-03-28T16:21:05Z")
You're right that was the problem. I have deleted in Kibana the mapping and added a new one actually that one from elasticsearch 7. The mapping for Elasticsearch 6 includings _default_ fields and those are not allowed anymore. So this default logstash template is not a good example. Same problem I have with the template for Winlogbeat. So the base question: which default logstash template should I use for 6.2 or 6.1? which default logstash template for winlogbeat should I use for 6.2 or 6.1? I think with this mapping it's a little bit confusing and not so easy to handle. I'm probably to stupid to add the template via: [https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-template.html#load-template-manually](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-template.html#load-template-manually) because I always to that via Kibana DevTools. It's probably the most dirty way to handle that? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 25, 2018, 4:21pm UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-geoip-location/125501/7 "2018-04-25T16:21:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.