# ES 7.0.1: GeoIp processor and geo\_point mapping troubles

**URL:** <https://discuss.elastic.co/t/es-7-0-1-geoip-processor-and-geo-point-mapping-troubles/180919>\
**Category:** Elasticsearch\
**Created:** [May 14, 2019, 5:00am UTC](https://discuss.elastic.co/t/es-7-0-1-geoip-processor-and-geo-point-mapping-troubles/180919 "2019-05-14T05:00:53Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Amit\_Saha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amit_saha/32/46116_2.png) [@Amit\_Saha](https://discuss.elastic.co/u/Amit_Saha)\
**Post date:** [May 14, 2019, 5:00am UTC](https://discuss.elastic.co/t/es-7-0-1-geoip-processor-and-geo-point-mapping-troubles/180919/1 "2019-05-14T05:00:53Z")

</div>

hi all, I am using [fluent-bit](https://github.com/fluent/fluent-bit/) to feed data into ES. I have the GeoIP processor "activated". My index mapping is [here](https://gist.github.com/amitsaha/26858b46dc233d54de219575222e397b). The Geo IP processor is doing it's job correctly, but on the ES side, I am getting this error:

```auto
{"type": "server", "timestamp": "2019-05-14T04:34:01,014+0000", "level": "DEBUG", "component": "o.e.a.b.TransportShardBulkAction", "cluster.name": "docker-cluster", "node.name": "ip-192-168-12-243.ap-southeast-2.compute.internal", "cluster.uuid": "H4SUXuGIQhWcMqL3hYBoKA", "node.id": "mhSlcK1gRNaKEnxM74agMg", "message": "[nginx_geoip][0] failed to execute bulk item (index) index {[nginx_geoip][flb_type][5XietGoBOBIN2Y3DZtOt], source[{\"remote_addr\":\"127.0.0.1\",\"request\":\"GET / HTTP/1.1\",\"real_ip\":\"8.8.8.8\",\"geoip\":{\"continent_name\":\"North America\",\"country_iso_code\":\"US\",\"location\":{\"lon\":-97.822,\"lat\":37.751}},\"response_status\":\"200\",\"body_bytes_sent\":\"12\",\"time_local\":\"14/May/2019:04:33:45 +0000\",\"request_method\":\"GET\",\"http_user_agent\":\"curl/7.29.0\",\"remote_user\":\"\",\"@timestamp\":\"2019-05-14T04:33:45.455Z\",\"request_time\":\"0.000\",\"http_referrer\":\"\"}]}" , 
"stacktrace": ["java.lang.IllegalArgumentException: mapper [geoip.location] of different type, current_type [geo_point], merged_type [ObjectMapper]",

```

To reproduce:

Create ES docker container:

```auto
sudo docker run --network=host -d -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" docker.elastic.co/elasticsearch/elasticsearch:7.0.1

```

Setup processor:

```auto
curl -X PUT "localhost:9200/_ingest/pipeline/geoip" -H 'Content-Type: application/json' -d' 
{
  "description" : "Add geoip info",
  "processors" : [
    {
      "geoip" : {
        "field" : "real_ip"
      }
    }
  ]
}

```

Create the index with settings above:

```auto
curl -H 'Content-Type: application/json' -XPUT "http://elasticsearch:9200/nginx_geoip" -d '
{mapping}
'

```

Try to ingest a document:

```auto
curl -H 'Content-Type: application/json' -XPOST 'http://localhost:9200/nginx_geoip/metrics?pipeline=geoip' -d '
{
  "real_ip": "192.30.253.113",
   "@timestamp":"2019-05-14T04:33:45.455Z"
}
'
{"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"mapper [geoip.location] of different type, current_type [geo_point], merged_type [ObjectMapper]"}],"type":"illegal_argument_exception","reason":"mapper [geoip.location] of different type, current_type [geo_point], merged_type [ObjectMapper]"},"status":400}

```

Any thoughts on where I am going wrong?

Thanks for any help!

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [May 14, 2019, 7:39am UTC](https://discuss.elastic.co/t/es-7-0-1-geoip-processor-and-geo-point-mapping-troubles/180919/2 "2019-05-14T07:39:03Z")

</div>

I think you need to change the `target` field to something else than `geoip` which is the default IIRC.

---

<div class="post-metadata">

**Author:** ![Amit\_Saha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amit_saha/32/46116_2.png) [@Amit\_Saha](https://discuss.elastic.co/u/Amit_Saha)\
**Post date:** [May 14, 2019, 11:57pm UTC](https://discuss.elastic.co/t/es-7-0-1-geoip-processor-and-geo-point-mapping-troubles/180919/3 "2019-05-14T23:57:36Z")

</div>

Thanks @dadoonet. I tried that, but no luck.

Example document and error:

```auto
{"type": "server", "timestamp": "2019-05-14T23:49:17,177+0000", "level": "DEBUG", "component": "o.e.a.b.TransportShardBulkAction", "cluster.name": "docker-cluster", "node.name": "ip-192-168-12-243.ap-southeast-2.compute.internal", "cluster.uuid": "3b3CwePfR2KOqyHadEG3uA", "node.id": "9utroxCiTcqxFse5KZyHTQ", "message": "[nginx_geoip][0] failed to execute bulk item (index) index {[nginx_geoip][flb_type][FyDAuGoB1J1VAp3oFCtY], source[{\"remote_addr\":\"127.0.0.1\",\"request\":\"GET / HTTP/1.1\",\"real_ip\":\"8.8.8.8\",\"iplocation\":{\"continent_name\":\"North America\",\"country_iso_code\":\"US\",\"location\":{\"lon\":-97.822,\"lat\":37.751}},\"response_status\":\"200\",\"body_bytes_sent\":\"12\",\"time_local\":\"14/May/2019:23:46:58 +0000\",\"request_method\":\"GET\",\"http_user_agent\":\"curl/7.29.0\",\"remote_user\":\"\",\"@timestamp\":\"2019-05-14T23:46:58.282Z\",\"request_time\":\"0.000\",\"http_referrer\":\"\"}]}" , 
"stacktrace": ["java.lang.IllegalArgumentException: mapper [iplocation.location] of different type, current_type [geo_point], merged_type [ObjectMapper]",

```

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [May 15, 2019, 5:08am UTC](https://discuss.elastic.co/t/es-7-0-1-geoip-processor-and-geo-point-mapping-troubles/180919/4 "2019-05-15T05:08:38Z")

</div>

I think (because the sample document is hard to read) that `iplocation.location` already exists so you can't choose it as a `target` field which I suppose you did.

Could you define `foo` as the `target`?

---

<div class="post-metadata">

**Author:** ![Amit\_Saha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amit_saha/32/46116_2.png) [@Amit\_Saha](https://discuss.elastic.co/u/Amit_Saha)\
**Post date:** [May 15, 2019, 6:00am UTC](https://discuss.elastic.co/t/es-7-0-1-geoip-processor-and-geo-point-mapping-troubles/180919/5 "2019-05-15T06:00:49Z")

</div>

Thanks again. I tried your suggestion with the same result. I have scripts [here](https://github.com/amitsaha/nginx-fluent-bit-es/tree/master/es) that I am using to test this.

To reproduce:

- `./setup-7.0.sh`
- `./create_es_index.sh`
- `./test_event.sh`

I get the following:

```auto
{
    "error": {
        "reason": "mapper [foo.location] of different type, current_type [geo_point], merged_type [ObjectMapper]",
        "root_cause": [
            {
                "reason": "mapper [foo.location] of different type, current_type [geo_point], merged_type [ObjectMapper]",
                "type": "illegal_argument_exception"
            }
        ],
        "type": "illegal_argument_exception"
    },
    "status": 400
}

```

Hopefully that's a bit clearer. Any idea as to what I am doing wrong?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [May 15, 2019, 5:22pm UTC](https://discuss.elastic.co/t/es-7-0-1-geoip-processor-and-geo-point-mapping-troubles/180919/6 "2019-05-15T17:22:58Z")

</div>

I'd remove this part from the mapping:

> <https://github.com/amitsaha/nginx-fluent-bit-es/blob/master/es/create_es_index.sh#L17-L41>

And let Elasticsearch at the first run, create the mapping for you.  
Then get the generated mapping to see how it has been modified.  
From this, edit the mapping, delete the index and put the mapping again.

And test again.

---

<div class="post-metadata">

**Author:** ![Amit\_Saha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amit_saha/32/46116_2.png) [@Amit\_Saha](https://discuss.elastic.co/u/Amit_Saha)\
**Post date:** [May 16, 2019, 12:56am UTC](https://discuss.elastic.co/t/es-7-0-1-geoip-processor-and-geo-point-mapping-troubles/180919/7 "2019-05-16T00:56:51Z")

</div>

Thanks. So i removed the `foo` mapping, create the index. Then I tried to post the document, I get:

```auto
amit@localhost ~/work/github.com/amitsaha/systemd-fluent-bit-es/es (master)$ ./test_event.sh 
{"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"Rejecting mapping update to [nginx_geoip] as the final mapping would have more than 1 type: [_doc, metrics]"}],"type":"illegal_argument_exception","reason":"Rejecting mapping update to [nginx_geoip] as the final mapping would have more than 1 type: [_doc, metrics]"},"status":400}

```

Further, i deleted the index entirely and created the document so that ES would create the index and mapping entirely. This is what I get (relevant part):

```auto
 "foo": {
        "properties": {
          "continent_name": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },
          "country_iso_code": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },
          "location": {
            "properties": {
              "lat": {
                "type": "float"
              },
              "lon": {
                "type": "float"
              }
            }
          }
        }
      },

```

Which is of course expected, but geo\_point is what i am after.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [May 16, 2019, 4:28am UTC](https://discuss.elastic.co/t/es-7-0-1-geoip-processor-and-geo-point-mapping-troubles/180919/8 "2019-05-16T04:28:49Z")

</div>

Can you now modify this mapping and change location to become a geopoint and create the index again?

---

<div class="post-metadata">

**Author:** ![Amit\_Saha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amit_saha/32/46116_2.png) [@Amit\_Saha](https://discuss.elastic.co/u/Amit_Saha)\
**Post date:** [May 16, 2019, 4:44am UTC](https://discuss.elastic.co/t/es-7-0-1-geoip-processor-and-geo-point-mapping-troubles/180919/9 "2019-05-16T04:44:41Z")

</div>

You mean:

```auto
..
"location": {
           "type": "geo_point",
            "properties": {
              "lat": {
                "type": "float"
              },
              "lon": {
                "type": "float"
              }
            }
          }

```

Assuming that's what you meant, i get this:

```auto
{
    "error": {
        "caused_by": {
            "reason": "Mapping definition for [location] has unsupported parameters: [properties : {lon={type=float}, lat={type=float}}]",
            "type": "mapper_parsing_exception"
        },
        "reason": "Failed to parse mapping [_doc]: Mapping definition for [location] has unsupported parameters: [properties : {lon={type=float}, lat={type=float}}]",
        "root_cause": [
            {
                "reason": "Mapping definition for [location] has unsupported parameters: [properties : {lon={type=float}, lat={type=float}}]",
                "type": "mapper_parsing_exception"
            }
        ],
        "type": "mapper_parsing_exception"
    },
    "status": 400
}

```

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [May 16, 2019, 5:20am UTC](https://discuss.elastic.co/t/es-7-0-1-geoip-processor-and-geo-point-mapping-troubles/180919/10 "2019-05-16T05:20:25Z")

</div>

I meant:

```
     "location": {
       "type": "geo_point"
        }
      }
```

---

<div class="post-metadata">

**Author:** ![Amit\_Saha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amit_saha/32/46116_2.png) [@Amit\_Saha](https://discuss.elastic.co/u/Amit_Saha)\
**Post date:** [May 16, 2019, 5:34am UTC](https://discuss.elastic.co/t/es-7-0-1-geoip-processor-and-geo-point-mapping-troubles/180919/11 "2019-05-16T05:34:08Z")

</div>

Right ok, i tried that and get back this error when posting a document:

```auto
{
    "error": {
        "reason": "mapper [foo.location] of different type, current_type [geo_point], merged_type [ObjectMapper]",
        "root_cause": [
            {
                "reason": "mapper [foo.location] of different type, current_type [geo_point], merged_type [ObjectMapper]",
                "type": "illegal_argument_exception"
            }
        ],
        "type": "illegal_argument_exception"
    },
    "status": 400
}

```

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [May 16, 2019, 2:38pm UTC](https://discuss.elastic.co/t/es-7-0-1-geoip-processor-and-geo-point-mapping-troubles/180919/12 "2019-05-16T14:38:50Z")

</div>

Here is what I tried on my side:

```auto
PUT /_ingest/pipeline/geoip
{
  "description" : "Add geoip info",
  "processors" : [
    {
      "geoip" : {
        "field" : "real_ip"
      }
    }
  ]
}

DELETE nginx_geoip
PUT nginx_geoip
{
  "mappings": {
    "properties": {
      "@timestamp": {
        "type": "date"
      },
      "geoip": {
        "properties": {
          "continent_name": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },
          "country_iso_code": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },
          "location": {
            "type": "geo_point"
          }
        }
      },
      "real_ip": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      }
    }
  }
}

PUT /nginx_geoip/_doc/1?pipeline=geoip
{
  "real_ip": "192.30.253.113",
  "@timestamp":"2019-05-14T04:33:45.455Z"
}
GET /nginx_geoip/_doc/1

```

This works well. Could you use that as a base?

---

<div class="post-metadata">

**Author:** ![Amit\_Saha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amit_saha/32/46116_2.png) [@Amit\_Saha](https://discuss.elastic.co/u/Amit_Saha)\
**Post date:** [May 16, 2019, 11:38pm UTC](https://discuss.elastic.co/t/es-7-0-1-geoip-processor-and-geo-point-mapping-troubles/180919/13 "2019-05-16T23:38:38Z")

</div>

Thanks - same issue with 7.0.1. Were you using the same version?

However, the interesting thing is, i got it to work with 6.4. My scripts are [here](https://github.com/amitsaha/nginx-fluent-bit-es/tree/master/es). Should I file a bug?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [May 17, 2019, 3:56am UTC](https://discuss.elastic.co/t/es-7-0-1-geoip-processor-and-geo-point-mapping-troubles/180919/14 "2019-05-17T03:56:29Z")

</div>

I tested it on 7.0.1.

Did you try the exact same script or did you modify it?  
If you did not change anything, I suspect that you have a template somewhere.

---

<div class="post-metadata">

**Author:** ![Amit\_Saha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amit_saha/32/46116_2.png) [@Amit\_Saha](https://discuss.elastic.co/u/Amit_Saha)\
**Post date:** [May 17, 2019, 4:24am UTC](https://discuss.elastic.co/t/es-7-0-1-geoip-processor-and-geo-point-mapping-troubles/180919/15 "2019-05-17T04:24:32Z")

</div>

the scripts i used for testing are in my above link (I used the 7.0 versions). Would you be able to use my scripts and verify that what you are suggesting is working for you?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [May 17, 2019, 4:38am UTC](https://discuss.elastic.co/t/es-7-0-1-geoip-processor-and-geo-point-mapping-troubles/180919/16 "2019-05-17T04:38:18Z")

</div>

Your script are failing. That's why I suggest you test mine and start from there.

---

<div class="post-metadata">

**Author:** ![Amit\_Saha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amit_saha/32/46116_2.png) [@Amit\_Saha](https://discuss.elastic.co/u/Amit_Saha)\
**Post date:** [May 17, 2019, 4:54am UTC](https://discuss.elastic.co/t/es-7-0-1-geoip-processor-and-geo-point-mapping-troubles/180919/17 "2019-05-17T04:54:46Z")

</div>

HI @dadoonet - i should have been clearer. My scripts do exactly what you suggested. Please take a look at them.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [May 17, 2019, 7:56am UTC](https://discuss.elastic.co/t/es-7-0-1-geoip-processor-and-geo-point-mapping-troubles/180919/18 "2019-05-17T07:56:19Z")

</div>

If your scripts are exactly the same I pasted, then I don't need to look at them as I tested my scripts and they were working well.

Did you try the script I shared? I mean just by copying pasting it in Kibana console and running it?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [May 17, 2019, 7:59am UTC](https://discuss.elastic.co/t/es-7-0-1-geoip-processor-and-geo-point-mapping-troubles/180919/19 "2019-05-17T07:59:17Z")

</div>

Anyway look at:

```
POST nginx_geoip/metrics

```

vs

```
PUT nginx_geoip/_doc/1

```

This makes at least 2 differences between our scripts.

---

<div class="post-metadata">

**Author:** ![dperetti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dperetti/32/46556_2.png) [@dperetti](https://discuss.elastic.co/u/dperetti)\
**Post date:** [May 21, 2019, 3:06pm UTC](https://discuss.elastic.co/t/es-7-0-1-geoip-processor-and-geo-point-mapping-troubles/180919/20 "2019-05-21T15:06:23Z")

</div>

I'm having a similar issue: [7.0.1: template with geo\_point + geoip processor in pipeline + bulk = crash](https://discuss.elastic.co/t/7-0-1-template-with-geo-point-geoip-processor-in-pipeline-bulk-crash/182039)

[Next page](https://discuss.elastic.co/t/es-7-0-1-geoip-processor-and-geo-point-mapping-troubles/180919.md?page=2)