# Geoip creates everything but the geoip.location **URL:** \ **Category:** Logstash\ **Created:** [March 30, 2018, 7:14pm UTC](https://discuss.elastic.co/t/geoip-creates-everything-but-the-geoip-location/126272 "2018-03-30T19:14:38Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Robert\_Bardo](https://avatars.discourse-cdn.com/v4/letter/r/e9bcb4/32.png) [@Robert\_Bardo](https://discuss.elastic.co/u/Robert_Bardo)\ **Post date:** [March 30, 2018, 7:14pm UTC](https://discuss.elastic.co/t/geoip-creates-everything-but-the-geoip-location/126272/1 "2018-03-30T19:14:39Z")
Hello, I have been just banging my head on the keyboard trying to figure out why all fields are created in my event but the ".location" field I understand that with the correct index mapping: - like so? ``` { ``` "template": ["logstash-_", "kafka-_", "filebeat-_"], "order": 0, "version": 60002, "index\_patterns": ["_"], "settings": { "index": { "refresh\_interval": "30s" } }, "mappings" : { "doc" : { "dynamic\_templates" : [ { "message\_field" : { "path\_match" : "message", "match\_mapping\_type" : "string", "mapping" : { "type" : "text", "norms" : false } } }, { "string\_fields" : { "match" : "\*", "match\_mapping\_type" : "string", "mapping" : { "type" : "text", "norms" : false, "fields" : { "keyword" : { "type": "keyword", "ignore\_above": 256 } } } } } ], "properties" : { "@timestamp": { "type": "date"}, "@version": { "type": "keyword"}, "source\_geo" : { "dynamic": true, "properties" : { "ip": { "type": "ip" }, "location" : { "type" : "geo\_point" }, "latitude" : { "type" : "half\_float" }, "longitude" : { "type" : "half\_float" }, "lat" : { "type" : "half\_float" }, "lon" : { "type" : "half\_float" } } }, "destination\_geo" : { "dynamic": true, "properties" : { "ip": { "type": "ip" }, "location" : { "type" : "geo\_point" }, "latitude" : { "type" : "half\_float" }, "longitude" : { "type" : "half\_float" }, "lat" : { "type" : "half\_float" }, "lon" : { "type" : "half\_float" } } } } } } } ...and part of my logstash config: ``` geoip { source => "[destination_ip]" target => "destination_geo" fields => ["city_name", "continent_code", "country_code2", "country_name", "region_name", "location", "latitude", "longitude"] #add_field => { "destination_geo.location" => ["%{destination_geo.lat}", "%{destination_geo.lon}"] } } ``` Results... Still I only get events that contain all the geo fields specified to display but the ".location" , hence I can not create a tile map... ( I don't understand why there is a .location.lat and .location.lon ) ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/6/d6a5eae198593695703d984ad410fd6b213f1728.png) \*Additionally, if I un-comment the unneeded "add-field" line - I am met with logstash errors like this: (so I know its not right): ... argument\_exception", "reason"=\>"illegal latitude value [269.99999983236194] for source\_geo.location"}}}} Could anyone help?!?!? Yes - when I do look at the specific index mapping the fields are correctly mapped on the live index... (partial output) ``` "destination_geo": { "dynamic": "true", "properties": { "city_name": { "type": "text", "norms": false, "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "continent_code": { "type": "text", "norms": false, "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "country_code2": { "type": "text", "norms": false, "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "country_name": { "type": "text", "norms": false, "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "ip": { "type": "ip" }, "latitude": { "type": "half_float" }, "location": { "type": "geo_point" }, "longitude": { "type": "half_float" }, "region_name": { "type": "text", "norms": false, "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } } } }, ``` To note: I am simply updating the "logstash" mapping at the dev console with a "PUT". Not useing a special mapping template name and not specifying anything in the Logstash- elasticsearch output plugin params. Thanks! ---
**Author:** ![atira](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/atira/32/28699_2.png) [@atira](https://discuss.elastic.co/u/atira)\ **Post date:** [March 30, 2018, 7:32pm UTC](https://discuss.elastic.co/t/geoip-creates-everything-but-the-geoip-location/126272/2 "2018-03-30T19:32:56Z")
I had the same issue. Your ES template is a bit hard to read without indentation, so I'll ask: Is the `destination_geo` inside or outside the main `properties`? It should be inside. To me it seems to be outside. Put it together with the others, like source `@timestamp`, `@version` and `source_geo` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 30, 2018, 7:39pm UTC](https://discuss.elastic.co/t/geoip-creates-everything-but-the-geoip-location/126272/3 "2018-03-30T19:39:30Z")
> [@Robert\_Bardo](#): > > Still I only get events that contain all the geo fields specified to display but the ".location" , hence I can not create a tile map... ( I don't understand why there is a .location.lat and .location.lon ) I don't understand why you think this is a problem. location is a geo\_point, and geo\_point objects contain a lat and a lon. What do you see in Kibana when you try to create a map? ---
**Author:** ![atira](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/atira/32/28699_2.png) [@atira](https://discuss.elastic.co/u/atira)\ **Post date:** [March 30, 2018, 7:43pm UTC](https://discuss.elastic.co/t/geoip-creates-everything-but-the-geoip-location/126272/4 "2018-03-30T19:43:09Z")
He's missing this: ![geoip](https://us1.discourse-cdn.com/elastic/original/3X/f/f/ff7f99266179499649ae5484335c451febc07736.JPG) He has the destination\_geo field mapping outside of properties. edit: or doesn't. Having trouble with missing indentation. ---
**Author:** ![Robert\_Bardo](https://avatars.discourse-cdn.com/v4/letter/r/e9bcb4/32.png) [@Robert\_Bardo](https://discuss.elastic.co/u/Robert_Bardo)\ **Post date:** [March 30, 2018, 7:44pm UTC](https://discuss.elastic.co/t/geoip-creates-everything-but-the-geoip-location/126272/5 "2018-03-30T19:44:05Z")
i was getting an error in the red circle.. "no field with geopiont data" yada yada.. ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/7/77510f51a1221a2137cfa079f2f58e69a67f1755.png) Now... just now.... it magically gives me a drop down. but yest @atira you are correct! more to follow, in a few... thanks guys.... ---
**Author:** ![Robert\_Bardo](https://avatars.discourse-cdn.com/v4/letter/r/e9bcb4/32.png) [@Robert\_Bardo](https://discuss.elastic.co/u/Robert_Bardo)\ **Post date:** [March 30, 2018, 7:46pm UTC](https://discuss.elastic.co/t/geoip-creates-everything-but-the-geoip-location/126272/6 "2018-03-30T19:46:48Z")
going to fiddle with it more and update you guys, but here is a pic from y editor since the dang form didnt take my code nicely.. 🙂 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/7/57326873fecaff158e3b152fccfc4acc50c7a9a8.png) ---
**Author:** ![atira](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/atira/32/28699_2.png) [@atira](https://discuss.elastic.co/u/atira)\ **Post date:** [March 30, 2018, 7:59pm UTC](https://discuss.elastic.co/t/geoip-creates-everything-but-the-geoip-location/126272/7 "2018-03-30T19:59:17Z")
I'm not sure but [see here](https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html#plugins-filters-geoip-fields). `location` doesn't seem to be an available choice, yet you have it in your logstash config. ---
**Author:** ![Robert\_Bardo](https://avatars.discourse-cdn.com/v4/letter/r/e9bcb4/32.png) [@Robert\_Bardo](https://discuss.elastic.co/u/Robert_Bardo)\ **Post date:** [March 30, 2018, 8:03pm UTC](https://discuss.elastic.co/t/geoip-creates-everything-but-the-geoip-location/126272/8 "2018-03-30T20:03:13Z")
Yes, geo field mappings are inside the main properties. ---
**Author:** ![Robert\_Bardo](https://avatars.discourse-cdn.com/v4/letter/r/e9bcb4/32.png) [@Robert\_Bardo](https://discuss.elastic.co/u/Robert_Bardo)\ **Post date:** [March 30, 2018, 8:23pm UTC](https://discuss.elastic.co/t/geoip-creates-everything-but-the-geoip-location/126272/9 "2018-03-30T20:23:02Z")
Well, after removing the 'fields" line from my logstash config - within the geoip params I see all the glorious events made available by the plugin. like so... ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/6/166deb65654ff93049eaa70a40d76219cc22fbe7.png) still I do not see the ".location" like what @atira makes an example of above. My tile maps do find the field needed though. Magically. I just dont understand why I do not see it in both places. Discover and KibanaVisualization editor drop down for buckets. I'll let it ride as my maps work. Thanks guys!! ---
**Author:** ![Robert\_Bardo](https://avatars.discourse-cdn.com/v4/letter/r/e9bcb4/32.png) [@Robert\_Bardo](https://discuss.elastic.co/u/Robert_Bardo)\ **Post date:** [April 2, 2018, 5:19pm UTC](https://discuss.elastic.co/t/geoip-creates-everything-but-the-geoip-location/126272/10 "2018-04-02T17:19:02Z")
Not sure why, but today it all displays just fine. Could it be an index / re-index thing? shard delete/merges that needed to take place for the change to be visible? Thanks again guys! ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/5/3502682c598815635fc6a0bd79df2d4224949b47.png) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 30, 2018, 5:19pm UTC](https://discuss.elastic.co/t/geoip-creates-everything-but-the-geoip-location/126272/11 "2018-04-30T17:19:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.