input{ kafka{ codec => "json" decorate_events => true ...... } } filter { geoip { source => "remote_addr" target => "geoip" add_field => ["[geoip][coordinates]","%{[geoip][longitude]}"] add_field => ["[geoip][coordinates]","%{[geoip][latitude]}"] …

[image] wajika: is there any way to make the custom index use the default logstash template? Take the default template , update the value of index_patterns to match your custom index name, and PUT it into elasticsearch.

Discuss the Elastic Stack

Does logstash map to geo_point type when parsing geoip?

Elastic Stack Logstash

wajika (wajika) July 13, 2020, 5:28am 3

Solved the problem, thank you

Topic		Replies	Views
GEO data still needs to use default template? Logstash	2	721	July 6, 2017
How to create a geo_point field in logstash for a default index logstash-* Logstash	6	770	August 4, 2018
Geoip filter not creating type geo_point Logstash	3	1841	July 6, 2017
Change GEO.LOCATION to GEO_POINT data type Elasticsearch	20	9793	March 3, 2017
Geo_point missing Logstash	6	2006	April 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Does logstash map to geo_point type when parsing geoip?

Related topics