Geoip field scope seperator is "." and not supported as mapping name

(Daniel) #1

I'm using the geoip mapping and everything seems fine, except the geoip ends up using a . as the seperator, example geoip.location, geoip.city_name, geoip.country_name. The period is not supported and the error message is
"reason"=>"Field name [] cannot contain '.'"}}}}

This makes sense and all of my other mappings don't contain periods. I think i read the period isnt supported in ES 2.x, so my question is, how do I rename the geoip seperator? My mappings are correct as shown below, but I don't know how to tell logstash not to use the "." as the field name, but to use something like an _ underscore. I've tried the mutate and gsub, but don't really know how to use them in this context or if this is the correct context to use mutate gsub.

      "geoip" : {
        "properties" : {
          "city_name" : {
            "type" : "string"
          "continent_code" : {
            "type" : "string"
          "country_code2" : {
            "type" : "string"
          "country_code3" : {
            "type" : "string"

(David Pilato) #2

Apparently you renamed the target field to be "remote_location", no?

If so you need to define it in your mapping accordingly.

(Daniel) #3

thanks for your reply David. I didn't rename remote_location from "remote.location", but even if i did the problem would be even greater as the "." in "remote.location" wouldn't be supported by ES 2.x

Actually, I just read more carefully and it looks like in 2.4.x there's a system property to enable support called mapper.allow_dots_in_name

I'm running 2.4.6, I'm gonna give that property setting a test.

(David Pilato) #4

It is supported if you define the correct mapping.

Where basically remote is an object and location is a field.

(Daniel) #5

no luck, maybe it's only a 2.4.0 field? 2.4.6 says the property doesn't exist for mapper.allow_dots_in_name. I'm going to investigate my other logstash installs to see if remote_location has a different name there. The thing is, I only used remote_location as an example here, but all of the geoip fields use a "." period separator, so it's not something I renamed. I did rename other fields/mappings to work around the period and those work correctly, just the geoip, which isn't something controlled by me as it's a properties thing *I think

(David Pilato) #6

Can you reproduce this with a simple elasticsearch pure script (without logstash)?


  • delete index
  • create index with mapping
  • index a doc

(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.