Hello, I was already asking about this on Jan 12, but with no solution. Meanwhile I have upgraded to ELK 5.2.1 so I tried again, but still can't get geoip working. The logstash filter is minimalistic: geoip { source => "[attrs][source]" } The mapping is: "geoip":{"dynamic":false,"type":"objec…

Aha! It works now. Your mapping puts the geo_point underneath the mapping _type of event. If you do not send the event through Logstash with the correct document_type, then the mapping template will not apply, as the default document_type in Logstash is logs. With this configuration: input { stdi…

Discuss the Elastic Stack

ELK 5.2.1 - still can't get geoip working

Elastic Stack Logstash

warkolm (Mark Walkom) February 25, 2017, 7:59am 2

Can you check the ES logs as well?

Topic		Replies	Views
Geop.location not of geo_pooint. elastic.co 5.6.4 on RPI3 Elasticsearch	15	1805	July 1, 2018
No geo_point fields logstash 6 Logstash	28	7011	March 3, 2018
Geoip filter not creating type geo_point Logstash	3	1850	July 6, 2017
Geoip.location not getting mapped to a geo_point type Elasticsearch	3	9874	April 12, 2017
Geo_point : elastisearch 5.6.4 on RPI3 Elasticsearch	9	470	June 19, 2018

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

ELK 5.2.1 - still can't get geoip working

Related topics