# GeoIP data present but cannot be displayed **URL:** \ **Category:** Kibana\ **Created:** [April 16, 2018, 8:17am UTC](https://discuss.elastic.co/t/geoip-data-present-but-cannot-be-displayed/128127 "2018-04-16T08:17:46Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![rcoundon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcoundon/32/30010_2.png) [@rcoundon](https://discuss.elastic.co/u/rcoundon)\ **Post date:** [April 16, 2018, 8:17am UTC](https://discuss.elastic.co/t/geoip-data-present-but-cannot-be-displayed/128127/1 "2018-04-16T08:17:46Z")
I'm not sure if this is a Kibana issue or an Elasticsearch issue. I have a logstash pipeline that is submitted data from an nginx access.log to ES. I'm using the geoip plugin to resolve the clientip to an address and lat/long. This all works and I see the following data in Kibana: | # geoip.latitude | | 51.347 | | --- | --- | --- | | # geoip.location.lat | | 51.347 | | # geoip.location.lon | | -0.787 | | # geoip.longitude | | -0.787 | | t geoip.postal\_code | | GU47 | | t geoip.region\_code | | BRC | | t geoip.region\_name | | Bracknell Forest | However, if I try to create a visualisation for this I get the message and select geohash as the aggregation I get the message: No Compatible Fields: The "test\*" index pattern does not contain any of the following field types: geo\_point In the index definition I have: ``` "geoip": { "properties": { "city_name": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "continent_code": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "country_code2": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "country_code3": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "country_name": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "ip": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "latitude": { "type": "float" }, "location": { "properties": { "lat": { "type": "float" }, "lon": { "type": "float" } } }, "longitude": { "type": "float" }, "postal_code": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "region_code": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "region_name": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "timezone": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } } } } ``` Can anyone help me see what's going wrong here? Many thanks ---
**Author:** ![Bill\_McConaghy](https://avatars.discourse-cdn.com/v4/letter/b/ed655f/32.png) [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)\ **Post date:** [April 16, 2018, 1:06pm UTC](https://discuss.elastic.co/t/geoip-data-present-but-cannot-be-displayed/128127/2 "2018-04-16T13:06:38Z")
The issue lies in the mapping for the index. See this documentation [https://www.elastic.co/guide/en/elasticsearch/reference/current/geo-point.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/geo-point.html) for details. TLDR, your location attribute should look like this: `"location": { "type": "geo_point" }` ---
**Author:** ![rcoundon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcoundon/32/30010_2.png) [@rcoundon](https://discuss.elastic.co/u/rcoundon)\ **Post date:** [April 16, 2018, 8:08pm UTC](https://discuss.elastic.co/t/geoip-data-present-but-cannot-be-displayed/128127/3 "2018-04-16T20:08:15Z")
Thanks Bill, I had taken a look at that but I think what's gotten me a bit confused is what I'd read on this blog: [https://www.elastic.co/blog/geoip-in-the-elastic-stack](https://www.elastic.co/blog/geoip-in-the-elastic-stack) Given I'm using the geoip plugin as described in that blog and the index is automatically created via the elasticsearch output plugin, why isn't the location attribute it being created as a geo\_point type automatically? Is there something additional I need to do to make that happen? ---
**Author:** ![Bill\_McConaghy](https://avatars.discourse-cdn.com/v4/letter/b/ed655f/32.png) [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)\ **Post date:** [April 16, 2018, 8:25pm UTC](https://discuss.elastic.co/t/geoip-data-present-but-cannot-be-displayed/128127/4 "2018-04-16T20:25:53Z")
I think the issue is that the automatic mapper is not smart enough to see that that is a geoip point. So you will need to recreate the index with the right mapping for that field and reindex the data. ---
**Author:** ![rcoundon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcoundon/32/30010_2.png) [@rcoundon](https://discuss.elastic.co/u/rcoundon)\ **Post date:** [April 16, 2018, 9:29pm UTC](https://discuss.elastic.co/t/geoip-data-present-but-cannot-be-displayed/128127/5 "2018-04-16T21:29:13Z")
I've gone and deleted the old index and had logstash recreate it and I can now create a visualisation referencing the location. This would seem to imply that the types are correct now but something else is going on. I definitely have data resolved to IP addresses in the index but the problem I have now is that no data is shown. Where to look now? ---
**Author:** ![Bill\_McConaghy](https://avatars.discourse-cdn.com/v4/letter/b/ed655f/32.png) [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)\ **Post date:** [April 16, 2018, 10:08pm UTC](https://discuss.elastic.co/t/geoip-data-present-but-cannot-be-displayed/128127/6 "2018-04-16T22:08:56Z")
Not sure what you mean when you say no data is shown. In Discover? ---
**Author:** ![rcoundon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcoundon/32/30010_2.png) [@rcoundon](https://discuss.elastic.co/u/rcoundon)\ **Post date:** [April 17, 2018, 6:11am UTC](https://discuss.elastic.co/t/geoip-data-present-but-cannot-be-displayed/128127/7 "2018-04-17T06:11:43Z")
Sorry, fair point, I wasn't clear. I see the data in Discover with lat and long: ![LocationDiscover](https://us1.discourse-cdn.com/elastic/original/3X/8/5/8588807007c03ff54e20579cfa40b1eb9c4664c2.png) But not in my visualization which is defined like: ![Vis](https://us1.discourse-cdn.com/elastic/original/3X/6/d/6d0c0bb1391c586281e4eedd6920a5644d68c0e9.png) ![Map](https://us1.discourse-cdn.com/elastic/original/3X/b/c/bccffaf488ae10f8d7f961f0295f6d33709942ef.jpg) ---
**Author:** ![rcoundon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcoundon/32/30010_2.png) [@rcoundon](https://discuss.elastic.co/u/rcoundon)\ **Post date:** [April 17, 2018, 6:44am UTC](https://discuss.elastic.co/t/geoip-data-present-but-cannot-be-displayed/128127/8 "2018-04-17T06:44:52Z")
Ok, I think I've gotten this working I defined an entirely new index specifying the location attribute as a geo\_point as you first described. I then used \_reindex to copy the documents from the old to the new, and repointed my logstash servers at the new index and the data is showing on the map. I guess I just found it a little odd that the visualization seemed to think the data type was fine in the definition of that visualization but couldn't actually display it. Thanks very much for taking the time to help me ---
**Author:** ![Bill\_McConaghy](https://avatars.discourse-cdn.com/v4/letter/b/ed655f/32.png) [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)\ **Post date:** [April 17, 2018, 11:30am UTC](https://discuss.elastic.co/t/geoip-data-present-but-cannot-be-displayed/128127/9 "2018-04-17T11:30:35Z")
Awesome, glad things are working for you now. I think the setup could be improved for sure. It might be worth putting in a logstash Github issue outlining the steps you went through and the pain points. I know they are working on streamlining things and stories like this could be helpful in that effort. ---
**Author:** ![rcoundon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcoundon/32/30010_2.png) [@rcoundon](https://discuss.elastic.co/u/rcoundon)\ **Post date:** [April 18, 2018, 9:01am UTC](https://discuss.elastic.co/t/geoip-data-present-but-cannot-be-displayed/128127/10 "2018-04-18T09:01:09Z")
Thanks Bill, no problem, I'll do that ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 16, 2018, 9:01am UTC](https://discuss.elastic.co/t/geoip-data-present-but-cannot-be-displayed/128127/11 "2018-05-16T09:01:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.