Hope its not a repeat so here is my setup.
filebeat out put to logstash (Apache access logs . due to some reasons we don't want to use Apache module ) . As elastic 7 has geoip plugin embeded all im doing in my logstash file is this along with my grok patterns.
geoip {
source => "clientip"
target => "geoip"
add_tag => [ "webserver-geoip" ]
}
I m able to get all geo field populated. so far no issues. Issue is that geo.location was not type of geo_point. I deleted all exisitng indices ,and i added following mapping .
PUT myindex-
{
"mappings": {
"properties": {
"geoip": {
"dynamic": true,
"properties": {
"location": {
"type": "geo_point"
}
}
}
}
}
}
I restarted filebeat by clearing registry. I get all documents ingested without issues. I refreshed the index pattern , i see geo.location is of type geo_point now. But there is nothing in it. No values.
I also treid exporting my document structure , made a template , added that in my ES , after going through standard process of registry and restarting filebeat , all docuemnt were ingested but there was nothing in document except timestamp
am i missing something very small thing to make this work ?
Raj