# Geoip configuration problem

**URL:** <https://discuss.elastic.co/t/geoip-configuration-problem/50946>\
**Category:** Logstash\
**Created:** [May 25, 2016, 2:29pm UTC](https://discuss.elastic.co/t/geoip-configuration-problem/50946 "2016-05-25T14:29:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Giulio](https://avatars.discourse-cdn.com/v4/letter/g/45deac/32.png) [@Giulio](https://discuss.elastic.co/u/Giulio)\
**Post date:** [May 25, 2016, 2:29pm UTC](https://discuss.elastic.co/t/geoip-configuration-problem/50946/1 "2016-05-25T14:29:50Z")

</div>

Hi  
Sorry if I disturb you again but I after read many and many threads about this problem I still can't understand why my configuration simply won't work!

This i my logastash cofiguration:

`
input {
    file {
        type => "access_apache"
        sincedb_path => "/dev/null"
        path => "/usr/log_accesso_web.log"
        start_position => beginning
        ignore_older => 86400000
    }
}
filter {
if [type] == "access_apache" {
csv {
columns => [
"clientIP",
"sslProt",
"chiper",
"sslClient",
"auth",
"timestamp",
"uniqueID",
"httpVersion",
"request",
"keepAlive",
"pathFolder",
"query",
"status",
"rBytes",
"header",
"referer",
"response",
"connection",
"bReceived",
"bSent"
]
separator =>" "
remove_field => ["message"]
}
geoip {
source => "clientIP"
database => "/etc/logstash/GeoLiteCity.dat"
}
mutate {
convert => ["keepAlive", "integer"]
convert => ["rBytes", "integer"]
convert => ["response", "integer"]
convert => ["bReceived", "integer"]
convert => ["bSent", "integer"]
convert => ["[geoip][postal_code]", "integer"]
convert => ["[geoip][latitude]", "float"]
convert => ["[geoip][longitude]", "float"]
}
}
if "_csvparsefailure" in [tags] {
mutate {
replace => { "type" => "failure_access_apache" }
}
}
}
output {
if [type] == "access_apache" {
elasticsearch {
hosts => ["192.168.122.128:9200"] #["192.168.122.104:9200", "192.168.122.238:9200", "192.168.122.55:9200"]
index => "apache-%{+YYYY.MM.dd}"
}
}
if [type] == "failure_access_apache" {
elasticsearch {
hosts => ["192.168.122.128:9200"] #["192.168.122.104:9200", "192.168.122.238:9200", "192.168.122.55:9200"]
index => "failure_access_apache-%{+YYYY.MM.dd}"
}
}
stdout { codec => rubydebug }
}
`

And this is the mapping of my template (I must cut most of the elements because exceeded the 5000 character limit):  
`
"mappings": {
...
"geoip": {
"properties": {
"timezone": {
"type": "string"
},
"ip": {
"type": "string"
},
"latitude": {
"type": "float"
},
"country_code2": {
"type": "string"
},
"country_name": {
"type": "string"
},
"continent_code": {
"type": "string"
},
"country_code3": {
"type": "string"
},
"region_name": {
"type": "string"
},
"location": {
"type": "geo_point"
},
"real_region_name": {
"type": "string"
},
"postal_code": {
"type": "long"
},
"longitude": {
"type": "float"
}
}
},
....
`

When I try to ship the log i receive the follow error

"status"=\>400, "error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"mapper [geoip.location] of different type, current\_type [geo\_point], merged\_type [long]"}}}, :level=\>:warn}

Someone have an idea about what I'm doing wrong?

As always, may thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:56am UTC](https://discuss.elastic.co/t/geoip-configuration-problem/50946/2 "2017-07-06T04:56:14Z")

</div>