I'm using the beats-dashboards and I was trying to make client locations works
the problem is as following:
geoip.location field in packetbeat index is from type number, however in logstash index is the type of geoip.location geo_point.
any suggestions?
Not sure I understand your question to 100%. What kind of data do you have in your logstash index?
the logstash index collects the data from filebeats.
the point is, the type of geoip.location is correct in the logstash index (geo_point) however in the packetbeat index the type is shown as (number).
what is odd at this point is that I am not using geoip.location in any of logstash output to logstash index, I'm only using this field to output to the packetbeat index.
If you are going to enrich events with geo_point data using Logstash's geoip filter then you need to customize the index template for your index so that the field mappings are correct. The provided index template for Packetbeat does not specify field named geoip that is a geo_point, but the provided index template from Logstash does.
This topic was automatically closed after 21 days. New replies are no longer allowed.