# Elasticseach 2 geoip problem **URL:** \ **Category:** Elasticsearch\ **Created:** [October 31, 2015, 1:42am UTC](https://discuss.elastic.co/t/elasticseach-2-geoip-problem/33424 "2015-10-31T01:42:00Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![flopez](https://avatars.discourse-cdn.com/v4/letter/f/ac91a4/32.png) [@flopez](https://discuss.elastic.co/u/flopez)\ **Post date:** [October 31, 2015, 1:42am UTC](https://discuss.elastic.co/t/elasticseach-2-geoip-problem/33424/1 "2015-10-31T01:42:00Z")
Hi, I just upgraded a 1.7.1 instance of elasticsearch+logstash, and after upgrading and bringing up the services I'm getting this output from the elasticsearch log: 2015-10-30 18:34:14,041][DEBUG][action.admin.indices.create] [Charcoal] [logstash-2015.10.31] failed to create MapperParsingException[mapping [_default_]]; nested: MapperParsingException[Mapping definition for [geoip] has unsupported parameters: [path : full]]; at org.elasticsearch.cluster.metadata.MetaDataCreateIndexService$2.execute(MetaDataCreateIndexService.java:359) at org.elasticsearch.cluster.service.InternalClusterService$UpdateTask.run(InternalClusterService.java:388) at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.runAndClean(PrioritizedEsThreadPoolExecutor.java:225) at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.run(PrioritizedEsThreadPoolExecutor.java:188) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:745) Is this a known issue for 2.0 ? Is there any workaround for it ? Thanks Francisco ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [October 31, 2015, 11:23pm UTC](https://discuss.elastic.co/t/elasticseach-2-geoip-problem/33424/2 "2015-10-31T23:23:24Z")
It's probably this [https://www.elastic.co/guide/en/elasticsearch/reference/current/\_mapping\_changes.html#migration-meta-fields](https://www.elastic.co/guide/en/elasticsearch/reference/current/_mapping_changes.html#migration-meta-fields) ---
**Author:** ![mkh1973](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mkh1973/32/5628_2.png) [@mkh1973](https://discuss.elastic.co/u/mkh1973)\ **Post date:** [November 1, 2015, 1:02pm UTC](https://discuss.elastic.co/t/elasticseach-2-geoip-problem/33424/3 "2015-11-01T13:02:25Z")
Hi! I have the same issue; it's really frustrating! Since my migration to the 2.0.0 my ELK stack isn't writing any indexes anymore. On the one hand there's not really some kind of migration guide and on the other hand it seems that my ELK stack is falling apart. ---
**Author:** ![flopez](https://avatars.discourse-cdn.com/v4/letter/f/ac91a4/32.png) [@flopez](https://discuss.elastic.co/u/flopez)\ **Post date:** [November 2, 2015, 2:55am UTC](https://discuss.elastic.co/t/elasticseach-2-geoip-problem/33424/4 "2015-11-02T02:55:45Z")
This is what I did to fix it on the logstash box[es]: 1. In this file: ./vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.1.2-java/lib/logstash/outputs/elasticsearch/elasticsearch-template.json remove this line: **"path": "full",** to leave it like: "properties" : { "@version": { "type": "string", "index": "not\_analyzed" }, "geoip" : { "type" : "object", "dynamic": true, "properties" : { "location" : { "type" : "geo\_point" } } } 2.Added this to the ES output output { elasticsearch { ... template\_overwrite =\> true ... } } Hope this helps anyone having this issue also. Francisco ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 2, 2015, 4:08am UTC](https://discuss.elastic.co/t/elasticseach-2-geoip-problem/33424/5 "2015-11-02T04:08:56Z")
You'd be better off copying the template somewhere else and then using that, you run the risk over having that one overwritten during upgrades. ---
**Author:** ![paulz](https://avatars.discourse-cdn.com/v4/letter/p/cdc98d/32.png) [@paulz](https://discuss.elastic.co/u/paulz)\ **Post date:** [November 2, 2015, 6:12pm UTC](https://discuss.elastic.co/t/elasticseach-2-geoip-problem/33424/6 "2015-11-02T18:12:37Z")
Thank you very much for the soluton. It really helped. Just to understand... Could you explain the "2" point? What "template\_overwrite =\> true" do ? In my case (Ubuntu 14.04, ES installed three days ago from ES ubuntu repo) the elasticsearch-template.json has been already corrected. But without "template\_overwrite =\> true" it still didn't work. ---
**Author:** ![flopez](https://avatars.discourse-cdn.com/v4/letter/f/ac91a4/32.png) [@flopez](https://discuss.elastic.co/u/flopez)\ **Post date:** [November 2, 2015, 6:30pm UTC](https://discuss.elastic.co/t/elasticseach-2-geoip-problem/33424/7 "2015-11-02T18:30:12Z")
This is what I found in the Logstash docs: [https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-template\_overwrite](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-template_overwrite) My interpretation of it, is that with this setting = true, it makes the change done in step 1 work. ---
**Author:** ![shanec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shanec/32/4004_2.png) [@shanec](https://discuss.elastic.co/u/shanec)\ **Post date:** [November 5, 2015, 1:38am UTC](https://discuss.elastic.co/t/elasticseach-2-geoip-problem/33424/8 "2015-11-05T01:38:18Z")
Hey @flopez, @paulz, @mkh1973, FIrst, I want to thank you all for raising this! You caught something the logstash testing framework didn't catch regarding upgrades. This is an artifact of [this](https://github.com/logstash-plugins/logstash-output-elasticsearch/issues/94) issue, which was changed in 2.0. The logstash folks are going to update the upgrade documentation to reflect this manual step that may need to be done and look into updates to the testing framework to cover things like this in the future. And credit to @flopez for pointing everybody in the correct direction. Thanks again for helping! ---
**Author:** ![suyograo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suyograo/32/44898_2.png) [@suyograo](https://discuss.elastic.co/u/suyograo)\ **Post date:** [November 5, 2015, 10:16pm UTC](https://discuss.elastic.co/t/elasticseach-2-geoip-problem/33424/9 "2015-11-05T22:16:15Z")
Thanks again! Users may have custom template changes, so by default a Logstash upgrade will leave the template as is. Even if you don’t have a custom template, Logstash will not overwrite an existing template by default. We removed GeoIP mapping issue in 1.5, but folks who have migrated from 1.4 and before would still have this issue and advised to overwrite their templates. Please be sure to save your existing template if you have custom changes. Docs updated here: [https://www.elastic.co/guide/en/logstash/current/\_upgrading\_logstash\_and\_elasticsearch\_to\_2\_0.html](https://www.elastic.co/guide/en/logstash/current/_upgrading_logstash_and_elasticsearch_to_2_0.html) ---
**Author:** ![John\_Swank](https://avatars.discourse-cdn.com/v4/letter/j/43a26b/32.png) [@John\_Swank](https://discuss.elastic.co/u/John_Swank)\ **Post date:** [February 11, 2016, 5:07pm UTC](https://discuss.elastic.co/t/elasticseach-2-geoip-problem/33424/10 "2016-02-11T17:07:36Z")
Thanks ..... template\_overwrite =\> "true" fixed my problem. After a 2.1 upgrade I was getting no indices. Adding that flag to my elasticsearch {template\_overwrite =\> "true"} logstash-\>output settings fixed my problem. ---
**Author:** ![lindsayshow](https://avatars.discourse-cdn.com/v4/letter/l/5daacb/32.png) [@lindsayshow](https://discuss.elastic.co/u/lindsayshow)\ **Post date:** [June 23, 2016, 3:08am UTC](https://discuss.elastic.co/t/elasticseach-2-geoip-problem/33424/11 "2016-06-23T03:08:57Z")
Yep，I want to report a issue about packetbeat-1.2.3 and elasticsearch-2.3.3, there is a similar problem about [packetbeat-2016.06.23] failed to create. But，in the packetbeat.yml ，I have done just what you have said .like this template\_overwrite=”true" Thanks . ---
**Author:** ![krlplm](https://avatars.discourse-cdn.com/v4/letter/k/9fc29f/32.png) [@krlplm](https://discuss.elastic.co/u/krlplm)\ **Post date:** [October 15, 2016, 6:47pm UTC](https://discuss.elastic.co/t/elasticseach-2-geoip-problem/33424/12 "2016-10-15T18:47:52Z")
Hi, I am on Logstash 2.4 as indicated below, **# /opt/logstash/bin/logstash version** **logstash 2.4.0** Also, when cross-checked the file, /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.7.1-java/lib/logstash/outputs/elasticsearch/elasticsearch-template.json, the geo-ip section is as below which is intact with no mention of "path":"full" as per the above discussions. "properties" : { "@timestamp": { "type": "date" }, "@version": { "type": "string", "index": "not\_analyzed" }, "geoip" : { "dynamic": true, "properties" : { "ip": { "type": "ip" }, "location" : { "type" : "geo\_point" }, "latitude" : { "type" : "float" }, "longitude" : { "type" : "float" } } } } Also, the logstash output has the below config, output { elasticsearch { hosts =\> localhost index =\> "proxyfinal-%{+YYYY.MM.dd}" template\_overwrite =\> true } } However, I still encounter the same issue of "mapper parsing exception" as others have experienced. Logstash log as below, **"status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"Failed to parse mapping [_default_]: Mapping definition for [geoip] has unsupported parameters: [path : full]", "caused\_by"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"Mapping definition for [geoip] has unsupported parameters: [path : full]"}}}}, :level=\>:warn}** Could you please help !! ---
**Author:** ![edi](https://avatars.discourse-cdn.com/v4/letter/e/9de0a6/32.png) [@edi](https://discuss.elastic.co/u/edi)\ **Post date:** [December 7, 2016, 10:52am UTC](https://discuss.elastic.co/t/elasticseach-2-geoip-problem/33424/13 "2016-12-07T10:52:12Z")
Same problem here. How can I find the mapping which is used? ---
**Author:** ![edi](https://avatars.discourse-cdn.com/v4/letter/e/9de0a6/32.png) [@edi](https://discuss.elastic.co/u/edi)\ **Post date:** [December 7, 2016, 11:40am UTC](https://discuss.elastic.co/t/elasticseach-2-geoip-problem/33424/14 "2016-12-07T11:40:51Z")
Got it! After listing all my templates(!) I found some that collided with the template I wanted. curl -sv localhost:9200/\_template | jq . leads to a formatted (thanks to jq!) list of all templates known to ES. Deleting all I don't need did it for me. There were several which used the same pattern for the index name but had the old mapping... ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 10:05pm UTC](https://discuss.elastic.co/t/elasticseach-2-geoip-problem/33424/15 "2017-07-05T22:05:13Z")