Elasticsearch 7.x and geo_point Type: can not do it via index_template mapping?

Elastic Stack Elasticsearch
1

I have an ES 7.1 cluster running locally. I forward some AWS ELB logs to it, via logstash. I am getting geoip data, but I want to use a Kibana visualization that relies on geo_point data type. RIght now I get an error in Kibana about not having geo_point in the index.

I use index_templates and I declare a mapping section to define location as a geo_point. It applies correctly, but when I check the index template it has no mappings associated with it. curl fragments below.

I am assuming and want to verify that this is because mapping types were remove in 7.x? and I will need to do this via in ingestion pipeline or at the logstash level?

Index Template

_template/test_template" -H 'Content-Type: application/json' -d'
{
  "index_patterns": [ "test_*" ],
  "settings": {
      "number_of_shards": "2",
      "number_of_replicas": "2"
    }
  },
  "mappings" : {
    "dynamic_templates" : [ {
      "message_field" : {
        "path_match" : "message",
        "match_mapping_type" : "string",
        "mapping" : {
          "type" : "text",
          "norms" : false
        }
      }
    }, {
      "string_fields" : {
        "match" : "*",
        "match_mapping_type" : "string",
        "mapping" : {
          "type" : "text", "norms" : false,
          "fields" : {
            "keyword" : { "type": "keyword", "ignore_above": 256 }
          }
        }
      }
    } ],
    "properties" : {
      "@timestamp": { "type": "date"},
      "@version": { "type": "keyword"},
      "geoip"  : {
        "dynamic": true,
        "properties" : {
          "ip": { "type": "ip" },
          "location" : { "type" : "geo_point" },
          "latitude" : { "type" : "half_float" },
          "longitude" : { "type" : "half_float" }
        }
      }
    }
  }

  "aliases": {}
}'

Index template check

_template/test_template | jq .
{
  "test_template": {
    "order": 0,
    "index_patterns": [
      "test_*"
    ],
    "settings": {
      "index": {
        "number_of_shards": "2",
        "number_of_replicas": "2"
      }
    },
    "mappings": {},
    "aliases": {}
  }
}
2

The body of your PUT index template is malformed. Delete line 6 - the extra }.
Then you will need a comma just before "aliases".

1 Like
3

Glen, Thank for that I see the mapping fields now. I'm see the mapping and the geoip.location is a geo_point and I'm getting geoip.lattitude and geoip.longitude being set. I'm still having issues where Kibana isn't finding any type with geo_point in the visualization.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.