# Elastic doesnt index after geo changes

**URL:** <https://discuss.elastic.co/t/elastic-doesnt-index-after-geo-changes/66544>\
**Category:** Elasticsearch\
**Created:** [November 18, 2016, 1:52pm UTC](https://discuss.elastic.co/t/elastic-doesnt-index-after-geo-changes/66544 "2016-11-18T13:52:16Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![xon](https://avatars.discourse-cdn.com/v4/letter/x/838e76/32.png) [@xon](https://discuss.elastic.co/u/xon)\
**Post date:** [November 18, 2016, 1:52pm UTC](https://discuss.elastic.co/t/elastic-doesnt-index-after-geo-changes/66544/1 "2016-11-18T13:52:16Z")

</div>

Hi there,

I am experiencing the same problem with here ( [Could not able to use geo\_ip in logstash 2.4 - #2 by magnusbaeck](https://discuss.elastic.co/t/could-not-able-to-use-geo-ip-in-logstash-2-4/63689/2) ) however my issue wasnt resolved.

I have the following configuration file

Logstash:

> filter {  
> grok {  
> match =\> { "message" =\> "%{COMBINEDAPACHELOG}"}  
> }  
> geoip {  
> source =\> "clientip"  
> target =\> "geoip"  
> database =\> "/etc/logstash/GeoLiteCity.dat"  
> add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ]  
> add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ]  
> }

> ```
> mutate {
> convert => ["[geoip][coordinates]", "float" ]
> 
> ```

> ```
> }
> 
> ```

> }

> output {  
> elasticsearch {  
> hosts =\> "10.0.0.15:9200"  
> manage\_template =\> true  
> index =\> "filebeat-%{+YYYY.MM.dd}"  
> document\_type =\> "apache"  
> }  
> }

The previous config file was working until I did the following changes:

> ```
> target => "geoip"
> database => "/etc/logstash/GeoLiteCity.dat"
> add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
> add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
> }
> 
> ```

> ```
> mutate {
> convert => ["[geoip][coordinates]", "float" ]
> 
> ```

I have checked all the other interactions (filebeat -\> redis -\> logstash) and everything is fine. I also tcpdumped logstash \<-\> elasticsearch and I can see them communicating however the index is not created.

> curl '[http://10.0.0.15:9200/\_cat/indices?v](http://10.0.0.15:9200/_cat/indices?v)'  
> health status index uuid pri rep docs.count docs.deleted store.size pri.store.size  
> yellow open messagebroker e3gRxR39QiuRQkGe0wFurA 5 1 0 0 800b 800b  
> yellow open flex2gateway 2TplJRbARjqu2PVeDJuQhA 5 1 0 0 800b 800b  
> yellow open blazeds uQhG\_F-3RzmSU3\_wQu9sVw 5 1 0 0 800b 800b  
> yellow open lcds EkSLDBoPRWitoXJX-vb5Kw 5 1 0 0 800b 800b  
> yellow open .kibana Qn07\_MIrQLmgYhT0usy\_2Q 1 1 15 4 50.6kb 50.6kb  
> yellow open phppath g5tXTMkCT1mcdh54CklTug 5 1 0 0 800b 800b  
> yellow open webui 82LKbALdRViLO8EFQK0wHA 5 1 0 0 800b 800b  
> yellow open samples l1JkFfWMTt6GMNFCMFk8rw 5 1 0 0 800b 800b  
> yellow open lcds-samples iEe3RmWdSaysdUQVBJbC3Q 5

I am using Logstash 5.0.1.

Any help please?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 16, 2016, 1:52pm UTC](https://discuss.elastic.co/t/elastic-doesnt-index-after-geo-changes/66544/2 "2016-12-16T13:52:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.