# Geo\_point missing

**URL:** https://discuss.elastic.co/t/geo-point-missing/77506
**Category:** Logstash
**Created:** [March 6, 2017, 1:42pm UTC](https://discuss.elastic.co/t/geo-point-missing/77506 "2017-03-06T13:42:38Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![lendoly](https://avatars.discourse-cdn.com/v4/letter/l/439d5e/32.png) [@lendoly](https://discuss.elastic.co/u/lendoly)
#### Post date: [March 6, 2017, 1:42pm UTC](https://discuss.elastic.co/t/geo-point-missing/77506/1 "2017-03-06T13:42:38Z")

</div>

Hello,

I saw a lot of questions and solutions for this issue in the forums, but no one of them solves my problem so I decided to ask.

My question is about the geo\_point, Kibana is telling this message when I'm trying to create a title map:  
`index pattern does not contain any of the following field types: geo_point`

And why I'm asking than in the Logstash forum? because I think the problem are in the Logstash side.

my pattern looks like this:

```auto
filter {
    if [type] == "nginx-access" {
        grok {
            patterns_dir => ["/opt/logstash/patterns"]
            match => ["message" , "%{NGINXACCESS}"]
            overwrite => ["message"]
        }

        geoip {
            source => "clientip"
            add_field => ["[geoip][location]", "%{longitude}" ]
            add_field => ["[geoip][location]", "%{latitude}" ]
        }

        date {
            match => ["timestamp" , "dd/MMM/YYYY:HH:mm:ss Z"]
        }

         mutate {
            convert => ["response", "integer"]
            convert => ["bytes", "integer"]
            convert => ["responsetime", "float"]
            convert => ["[geoip][location]", "float" ]
        }

        useragent {
            source => "agent"
        }
   }
}

  output {
    if [type] == "nginx-access" {
        elasticsearch {
            hosts => ["elasticsearch:9200"]
            index => "nginx-access-%{+YYYY.MM.dd}"
            template_name => "logstash"
        }
    }
}

```

The geoip filter is working nicely because the tag `_geoip_lookup_failure` is not appearing in the trace logs that have a correct IP.

I tried with and without the lines:

```auto
add_field => ["[geoip][location]", "%{longitude}" ]
add_field => ["[geoip][location]", "%{latitude}" ]
convert => ["[geoip][location]", "float" ]

```

Also with and without

```auto
 template_name => "logstash"

```

any hint about why geo\_poin is not in the index?

PS: other simple question there is a simple way to block the geoip filter if the IP is from localhost?

UPDATE: if I don't use the custom index and I use the default index it works good, so I think is some trouble with the template\_name, but not idea what is the problem.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 7, 2017, 8:36am UTC](https://discuss.elastic.co/t/geo-point-missing/77506/2 "2017-03-07T08:36:39Z")

</div>

> UPDATE: if I don't use the custom index and I use the default index it works good, so I think is some trouble with the template\_name, but not idea what is the problem.

Not the template name but the template pattern. The default index template that ships with Logstash matches indexes named logstash-\*. You have to supply another index template that matches your indexes (or manage the templates completely outside Logstash).

---

<div class="post-metadata">

### Author: ![lendoly](https://avatars.discourse-cdn.com/v4/letter/l/439d5e/32.png) [@lendoly](https://discuss.elastic.co/u/lendoly)
#### Post date: [March 8, 2017, 11:50am UTC](https://discuss.elastic.co/t/geo-point-missing/77506/3 "2017-03-08T11:50:52Z")

</div>

Ok thanks for the hint.

I'm reading this documentation [https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html), but still have some doubts, there is an easy way to propagate the template pattern of logstash to the other indexes? so I don't need to define the template\_name? is possible to add in the template field a wildcard or something like this?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 9, 2017, 1:32pm UTC](https://discuss.elastic.co/t/geo-point-missing/77506/4 "2017-03-09T13:32:25Z")

</div>

Sorry, I don't understand the question.

---

<div class="post-metadata">

### Author: ![lendoly](https://avatars.discourse-cdn.com/v4/letter/l/439d5e/32.png) [@lendoly](https://discuss.elastic.co/u/lendoly)
#### Post date: [March 9, 2017, 1:54pm UTC](https://discuss.elastic.co/t/geo-point-missing/77506/5 "2017-03-09T13:54:43Z")

</div>

Ok, let check If I can explain it in another way.

Is a way to tell to the logstash template pattern that not only match the index `lostash-*`, also my customs indexes?

like:

```auto
PUT _template/logstash
{
  "template": "*",
}

```

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 9, 2017, 2:15pm UTC](https://discuss.elastic.co/t/geo-point-missing/77506/6 "2017-03-09T14:15:21Z")

</div>

Oh. Sure, you can configure the template pattern to match all indexes as in your example, but I don't think you can say "logstash-\* _and_ otherindex-\*". Then you need to install two different templates.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 6, 2017, 2:15pm UTC](https://discuss.elastic.co/t/geo-point-missing/77506/7 "2017-04-06T14:15:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
