Geo_point expected error in Elasticsearch 5.0.0-alpha5

Elastic Stack Elasticsearch
1

When indexing geoip data with logstash 5.0.0-alpha5, some exception occurred.

Error message:

MapperParsingException[failed to parse]; nested: ElasticsearchParseException[geo_point expected];
at org.elasticsearch.index.mapper.DocumentParser.wrapInMapperParsingException(DocumentParser.java:188)
at org.elasticsearch.index.mapper.DocumentParser.parseDocument(DocumentParser.java:82)
at org.elasticsearch.index.mapper.DocumentMapper.parse(DocumentMapper.java:286)
at org.elasticsearch.index.shard.IndexShard.prepareIndex(IndexShard.java:511)
at org.elasticsearch.index.shard.IndexShard.prepareIndexOnPrimary(IndexShard.java:492)

geoip data inserted:

"dst_geoip": {
"timezone": "Asia/Seoul",
"ip": "2001:2d8:e22b:ba46:0:0:3191:ad",
"latitude": 36.5,
"continent_code": "AS",
"city_name": null,
"country_code2": "KR",
"country_name": "Republic of Korea",
"dma_code": null,
"country_code3": "KR",
"region_name": null,
"location": [127.75, 36.5],
"postal_code": null,
"longitude": 127.75,
"region_code": null
},

mapping:

"dst_geoip" : {
"dynamic" : false,
"properties" : {
"area_code":{"type":"long"},
"city_name":{"type":"text", "index":"not_analyzed"},
"asn":{"type":"text", "index":"not_analyzed"},
"number":{"type":"text", "index":"not_analyzed"},
"continent_code":{"type":"text"},
"coordinates":{"type":"text"},
"country_code2":{"type":"text"},
"country_code3":{"type":"text"},
"country_name":{"type":"text", "index":"not_analyzed"},
"dma_code":{"type":"long"},
"ip":{"type":"ip", "index":"not_analyzed"},
"latitude":{"type":"double"},
"longitude":{"type":"double"},
"postal_code":{"type":"text"},
"real_region_name":{"type":"text", "index":"not_analyzed"},
"region_name":{"type":"text", "index":"not_analyzed"},
"timezone":{"type":"text", "index":"not_analyzed"},
"location" : {
"type" : "geo_point"
}
},
"type" : "object"
}

What's wrong with my configuration?
If anyone knows, please let me know.
Thanks in advance.

2

Could you show the request that causes the error?

3

Here's my elasticsearch log reporting error.
I changed some IP to random numbers.
(I couldn't capture the request. sorry.)

[flowv6][AVcCvIq62YzxfydFt7d0], source[{"message":"2016-09-07 12:36:15,2016-09-07 12:36:15,0.000,2001:290:20:2001::d,2001:2d8:30c:dc83::e56:c0a0,443,54321,TCP,.A....,64,0,1,1280,0,0,43,38,0,9644,64,33,0,0,0.0.0.0,0.32.0.72,0,0,00:00:00:00:00:00,00:00:00:00:00:00,00:00:00:00:00:00,00:00:00:00:00:00,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0, 0.000, 0.000, 0.000,111.111.111.111,0/33,3,2016-09-07 12:36:31.892","@version":"1","@timestamp":"2016-09-07T03:41:31.988Z","path":"/home/madkoala/workspace/flow/netflow/data/nfdump-ascii/201609071236_csv_nfcapd.log","host":"es-stack-5-dev","type":"flowv6","tags":["xxx","netflow","ipv6"],"flow_start_time":"2016-09-07T12:36:15.000Z","flow_end_time":"2016-09-07T12:36:15.000Z","flow_duration":"0.000","src_ip":"2001:290:20:2001::d","dst_ip":"2001:2d8:30c:dc83::e56:c0a0","src_port":"443","dst_port":"54321","protocol":"TCP","tcp_flag":".A....","fwd_status":"64","src_tos":"0","input_pkts":"1","input_bytes":"1280","output_pkts":"0","output_bytes":"0","in_if":"43","out_if":"38","src_bgp_as":"0","dst_bgp_as":"9644","src_mask":"64","dst_mask":"33","dst_tos":"0","flow_dir":"0","next_hop_rtr":"0.0.0.0","bgp_next_hop_rtr":"0.0.0.0","src_vlan":"0","dest_vlan":"0","in_src_mac":"00:00:00:00:00:00","out_dst_mac":"00:00:00:00:00:00","in_dst_mac":"00:00:00:00:00:00","out_src_mac":"00:00:00:00:00:00","mpls1":"0-0-0","mpls2":"0-0-0","mpls3":"0-0-0","mpls4":"0-0-0","mpls5":"0-0-0","mpls6":"0-0-0","mpls7":"0-0-0","mpls8":"0-0-0","mpls9":"0-0-0","mpls10":"0-0-0","client_latency":" 0.000","server_latency":" 0.000","app_latency":" 0.000","rtr_ip":"0.0.0.0","engine":"0/33","exp_sys_id":"3","flow_received":"2016-09-07T12:36:31.892Z","src_geoip":{"ip":"111.111.111.111","country_code2":"KR","country_code3":"KOR","country_name":"Korea, Republic of","continent_code":"AS","region_name":"11","city_name":"Seoul","latitude":37.5985,"longitude":126.97829999999999,"timezone":"Asia/Seoul","real_region_name":"Seoul-t'ukpyolsi","location":[126.97829999999999,37.5985]}}]}
MapperParsingException[failed to parse]; nested: ElasticsearchParseException[geo_point expected];
at org.elasticsearch.index.mapper.DocumentParser.wrapInMapperParsingException(DocumentParser.java:188)
at org.elasticsearch.index.mapper.DocumentParser.parseDocument(DocumentParser.java:82)
at org.elasticsearch.index.mapper.DocumentMapper.parse(DocumentMapper.java:286)
at org.elasticsearch.index.shard.IndexShard.prepareIndex(IndexShard.java:511)
at org.elasticsearch.index.shard.IndexShard.prepareIndexOnPrimary(IndexShard.java:492)
at org.elasticsearch.action.index.TransportIndexAction.prepareIndexOperationOnPrimary(TransportIndexAction.java:174)
at org.elasticsearch.action.index.TransportIndexAction.executeIndexRequestOnPrimary(TransportIndexAction.java:179)
at org.elasticsearch.action.bulk.TransportShardBulkAction.shardIndexOperation(TransportShardBulkAction.java:348)
at org.elasticsearch.action.bulk.TransportShardBulkAction.index(TransportShardBulkAction.java:156)
at org.elasticsearch.action.bulk.TransportShardBulkAction.handleItem(TransportShardBulkAction.java:135)
at org.elasticsearch.action.bulk.TransportShardBulkAction.onPrimaryShard(TransportShardBulkAction.java:121)
at org.elasticsearch.action.bulk.TransportShardBulkAction.onPrimaryShard(TransportShardBulkAction.java:72)
at ... (omitted)