# Create geopoint data

**URL:** https://discuss.elastic.co/t/create-geopoint-data/107580
**Category:** Logstash
**Created:** [November 14, 2017, 4:06pm UTC](https://discuss.elastic.co/t/create-geopoint-data/107580 "2017-11-14T16:06:50Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Rym\_Guerbi\_Michaut](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rym_guerbi_michaut/32/25496_2.png) [@Rym\_Guerbi\_Michaut](https://discuss.elastic.co/u/Rym_Guerbi_Michaut)
#### Post date: [November 14, 2017, 4:06pm UTC](https://discuss.elastic.co/t/create-geopoint-data/107580/1 "2017-11-14T16:06:50Z")

</div>

Hi there,

I want to create a beautiful visualisation of some geopoints on a map.  
I have a small view of 5 points in a relational database and I'm trying to put a correct code in Logstash filter to import the right data in the right format.  
but I still don't know how to do it.

My view's format:  
Country\_name lat lon  
count1  
count2  
count3  
count4  
count5

How do I have to do to convert "lat" and "lon" values to geopoint.  
Good to know that they're already converted into "float" in the SELECT statement in the input part.

Could anyone help?

Thank's in advance.

Cordially,

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 14, 2017, 7:51pm UTC](https://discuss.elastic.co/t/create-geopoint-data/107580/2 "2017-11-14T19:51:26Z")

</div>

See [https://www.elastic.co/blog/geoip-in-the-elastic-stack](https://www.elastic.co/blog/geoip-in-the-elastic-stack) for some pointers. There are two things at play:

- Your ES index must be configured to map the lat/lon field in question as geo\_point. This is typically done with an index template. Logstash's default index template contains a geo\_point field that you can use, but keep in mind that the default template only matches indexes whose name match logstash-\* so if you're creative with the index naming you'll be disappointed.
- Logstash needs to send an event to ES where the field you want to have as geo\_point has a certain look. The requirements for such fields is described in ES's geo\_point documentation.

---

<div class="post-metadata">

### Author: ![Rym\_Guerbi\_Michaut](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rym_guerbi_michaut/32/25496_2.png) [@Rym\_Guerbi\_Michaut](https://discuss.elastic.co/u/Rym_Guerbi_Michaut)
#### Post date: [November 15, 2017, 9:23am UTC](https://discuss.elastic.co/t/create-geopoint-data/107580/3 "2017-11-15T09:23:13Z")

</div>

Hi magnusbaeck,

Thank's for the answer.  
Excuse my ignorance about ELK, I'm really new at it.  
I completely agree with the fact that the fields "lat" and "lon" have to be converted and that I have to do so with Logstash's filter before loading them in ES.  
The thing is that I haven't understood yet how to convert them with "geoip", function and mutate.

I'm actually using jcdb. Input and output are ok for me. If I've understood what you said, I have to rename the index something like: "logstash-positions\_gps".

My problem is in the filter part.  
How do I organize it? grok, geoip, mutate, rename, add\_field... ??? I don't know, where to start, what to put et and how to order it all...

The input is agencies' latitude and longitude positions picked-up on Google Maps.  
The aim is to put 5 agencies on a map with some conditions about their work.

Could you help please?

Thank's in advance,  
Rym

---

<div class="post-metadata">

### Author: ![Rym\_Guerbi\_Michaut](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rym_guerbi_michaut/32/25496_2.png) [@Rym\_Guerbi\_Michaut](https://discuss.elastic.co/u/Rym_Guerbi_Michaut)
#### Post date: [November 15, 2017, 11:11am UTC](https://discuss.elastic.co/t/create-geopoint-data/107580/4 "2017-11-15T11:11:25Z")

</div>

Hi magnusbaeck,

I think I found how to code it, and the data have been loaded on the right format: (see the file joined: ![Kibana](https://us1.discourse-cdn.com/elastic/original/3X/b/1/b1c0c4736c81e27395ab525d3903d7fb86edc85f.png) )

but no point showed on Kibana's coordinate map.

In input statement, I've called the function geohash\_encode:  
geohash\_encode(CAST(lat AS SIGNED),CAST(lon AS SIGNED),12) AS geohash

And in the filter  
filter {

```
geoip {
	source => ["POSITIONS_GPS"]
	}

}
```

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 15, 2017, 12:54pm UTC](https://discuss.elastic.co/t/create-geopoint-data/107580/5 "2017-11-15T12:54:41Z")

</div>

> The thing is that I haven't understood yet how to convert them with "geoip", function and mutate.

The geoip filter turns IP addresses into lat/lon values, but you already have the lat/lon values so you don't need that filter. All you need to do is

- store the lat/lon values in a field so that it can be recognized as geo\_point (see [Geopoint field type | Elasticsearch Guide [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/geo-point.html)),
- map that field as geo\_point in ES, possibly by using an index template.

> If I've understood what you said, I have to rename the index something like: "logstash-positions\_gps".

If you want to rely on Logstash's index template, yes. The template maps the `[geoip][location]` field as geo\_point.

So to summarize, name your index logstash-positions\_gps och store the lat/lon values in `[geoip][location]` in a format described in the docs I linked to above. If you want to customize the index name or the field name then that's fine, but I suggest you get it working first.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 13, 2017, 12:55pm UTC](https://discuss.elastic.co/t/create-geopoint-data/107580/6 "2017-12-13T12:55:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
