Geo location issues

[Raj_Kumar (Raj)]

Hi All,

Am using Elastic stack for analysing the syslogs and i have geo filter enabled in logstash configuration and when I visualize it kibana the values getting divided like this.

We know the Los angeles is a city ,but my values are coming separately for los and angeles ,if its a place with single name I dont have issues but if a place second name (like San Francisco , Los angeles ) logs are getting divided and it shows some logs for first name and some logs for second name.

Please any one can help me,it would be great:)

Thanks ,
Raj

[weltenwort (Felix Stürmer)]

Hi @Raj_Kumar,

the reason for the results you are seeing is that Elasticsearch analyzes string fields by default and therefore splits the field content into terms. To avoid that you have two possibilities, depending on the version of Elasticsearch that you are using.

If you are using version 5.0 or above, the unanalyzed contents of the string field country are stored in country.keyword automatically.

In previous versions you can enable a similar behavior by specifying not_analyzed as the index value of the field. See https://www.elastic.co/guide/en/elasticsearch/reference/2.4/multi-fields.html for examples.

In both cases, the city names contained in the properly configured fields will be treated as keywords and not individual terms for queries and should appear as expected in Kibana.

[Raj_Kumar (Raj)]

Thank you Felix for your reply ,let me try this