Thanks for your interest of helping me out.
I identified that many people went back to using the default logstash-* index for the geoip events, and I tried this too. I seems that ES has a default mapping of geo_point for the location field.
This makes my setup work, but my first problem is still that I don't understand the syntax of creating default mappings for new indexes.
Once, I managed to change the mapping of the location field in one index, but it was only for that index, all new (every day!) indexes was created again with the wrong mapping.
So, I just have to learn how this is supposed to be done.
I have been working with other SIEM-like products like Q1Radar, Splunk, TLC, ArcSight and LogPoint, but the architecture is very different with ES to all others.