ELK-5.3.1 Kibana Tile map - No Compatable Fields: geo_point

[lewis15 (Lewis Litchfield)]

Running ELK Stack 5.3.1
I am unable to create a Tile map because Kibana is defaulting to Field geo-point.
I have not been able to fine anything in the logs that makes any sense to me about what is wrong.
Sorry, no programing experience with Servers/PCs. Any help is appreciated

Picture1

Screen shot of missing geoip.location

This screen shot has a geoip.location

Event_data.IpAddress & geoip.location are available

Empty geoip.location

Some event logs have an IP address in the log & some do not have an IP Address. This is normal for Windows Event Logs. Windows produces a huge number of event logs for a single logon. Some have some good information & some have blank fields

Geoip selections available

Logstash config file

Thanks
Lewis

[warkolm (Mark Walkom)]

We just posted a blog about this topic that may help - https://www.elastic.co/blog/geoip-in-the-elastic-stack

[spalger (Spencer Alger)]

You also might need to refresh the field mappings in the Index Pattern (open your winlogbeat-* index pattern and click the little refresh button

[lewis15 (Lewis Litchfield)]

I must be doing something incorrectly./wrong. After refreshing or
rewriting the winlogbeat-* index the fields remain the same 371 & no geoip
field anywhere. Using the Console & the information in
https://www.elastic.co/guide/en/elasticsearch/plugins/5.3/using
-ingest-geoip.html I have almost the same results as indicated in the
document. The differences are minor - the line locations of the
information are not identical, but the information is the same. I do not
have anything like geo-point.
in any of my test systems that I am using to solve this problem.

Thanks for your help . I have learned a lot, but I am missing something.

[spalger (Spencer Alger)]

Are you refreshing/rewriting in elasticsearch? I was talking about in the Kibana Management app, choose "Index Patterns", then winlogbeat-* in the left column, and click the refresh button on the right hand side to refresh Kibana's cache of your fields

[lewis15 (Lewis Litchfield)]

Yes, that is what I did.

[lewis15 (Lewis Litchfield)]

Winlogstash1 is the management #1
Winlogstash2 select Add New
Winlogstash3 change from logstash-* to winlogstbeat-*
Winlogstash4 selected refresh fields I also saved a new index by removing
check in Index contains time based events..Had 371 fields, rechecked Index
contains time based events & saved, again only 371 events.

[lewis15 (Lewis Litchfield)]

Using https://www.elastic.co/blog/geoip-in-the-elastic-stack, I am stuck at
:

Next, we can save this pipeline to Elasticsearch
https://www.elastic.co/guide/en/elasticsearch/reference/5.3/put-pipeline-api.html,
set a template to make sure that the geoip valures are treated as a and
then use Filebeat to push data directly to our cluster for ingestion and
storage, with our added geoip info being added automatically!
Am I suppose to make any changes to:

PUT _ingest/pipeline/my-pipeline-id{
"description" : "describe pipeline",
"processors" : [
{
"set" : {
"field": "foo",
"value": "bar"
}
}
]}

If so, I don't know what fields to change or what.

Also how do I set a template?

Thanks.