Geo_point and the logstash-* index

Elastic Stack Logstash
1

When I use Logstash's geoip to encode an ip address, I get different field types in Elasticsearch when i use logstash-foo as an index vs logs-foo as an index.

logstash-foo (matches the default index naming convention) imports geoip.location as a geo_point field, where logs-foo imports geoip.location as a float.

I'm wondering why this happens and how I could get my arbitrary index, logs-foo, to import geoip.location fields as geo_point.

2

This is because Logstash installs an index template that says that the field in question should be a geo_point field, but this index template only applies to indexes whose name matches logstash-*.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.