# Geoip filter in logstash with Index Template not creating geo\_point object as expected
**URL:** https://discuss.elastic.co/t/geoip-filter-in-logstash-with-index-template-not-creating-geo-point-object-as-expected/286768
**Category:** Kibana
**Created:** [October 14, 2021, 6:27pm UTC](https://discuss.elastic.co/t/geoip-filter-in-logstash-with-index-template-not-creating-geo-point-object-as-expected/286768 "2021-10-14T18:27:46Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@ehfdub](https://discuss.elastic.co/u/ehfdub)
#### Post date: [October 14, 2021, 6:27pm UTC](https://discuss.elastic.co/t/geoip-filter-in-logstash-with-index-template-not-creating-geo-point-object-as-expected/286768/1 "2021-10-14T18:27:46Z")
Hello,
I have a geoip in my logstash filter:
```auto
geoip { source => "src_ip" }
```
and I created an index template via the Kibana DevTools for ALL new indexes:
```auto
PUT /_template/my_template
{
"order": 0,
"template": "*",
"mappings": {
"properties": {
"location": {
"type": "geo_point"
}
}
}
}
```
which appears as expected when I query it from Elasticsearch:
```auto
{
"my_template" : {
"order" : 0,
"index_patterns" : [
"*"
],
"settings" : { },
"mappings" : {
"properties" : {
"location" : {
"type" : "geo_point"
}
}
},
"aliases" : { }
}
}
```
but when a new index is created, the location.lat and location.lon fields still get mapped to floating point values instead of a geo\_point.
Can anyone point me to what I'm missing (not understanding) here?
Thanks,
Ehf
---
### Author:  [@Dzmitry](https://discuss.elastic.co/u/Dzmitry)
#### Post date: [October 20, 2021, 1:48pm UTC](https://discuss.elastic.co/t/geoip-filter-in-logstash-with-index-template-not-creating-geo-point-object-as-expected/286768/2 "2021-10-20T13:48:10Z")
Hi @ehfdub
I followed the recents [docs](https://www.elastic.co/guide/en/elasticsearch/reference/current/geo-point.html) and successfully created an index with geopoint field in Kibana 7.15.1, that was later recognized during index pattern creation in Kibana:
And this how it looks on Discover
What stack version do you use? Can you give it a try manually without logstash? If it will work, then you need to change logstash configuration, you can check the issue example [here](https://discuss.elastic.co/t/location-to-geo-point-mapping-not-working-with-logtash-and-kibana/160980)
Regards, Dzmitry
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [October 20, 2021, 1:55pm UTC](https://discuss.elastic.co/t/geoip-filter-in-logstash-with-index-template-not-creating-geo-point-object-as-expected/286768/3 "2021-10-20T13:55:18Z")
Your issue here is that the field you mapped as `geo_point` and the field with the location are not the same.
You mapped the `location` field, but your geolocation field is named `geoip.location`.
You should change your mapping or use `target => "location"` in your `geoip` filter on logstash.
---
### Author:  [@ehfdub](https://discuss.elastic.co/u/ehfdub)
#### Post date: [October 21, 2021, 4:22pm UTC](https://discuss.elastic.co/t/geoip-filter-in-logstash-with-index-template-not-creating-geo-point-object-as-expected/286768/4 "2021-10-21T16:22:22Z")
Thanks @leandrojmp
I appreciate your keen eye. Per your suggestion, I just updated my index template to
```auto
{
"my_template" : {
"order" : 0,
"index_patterns" : [
"*"
],
"settings" : { },
"mappings" : {
"properties" : {
"geoip.location" : {
"type" : "geo_point"
}
}
},
"aliases" : { }
}
}
```
I will check back tomorrow after a new index is created and verify it's working as expected.
Thanks,
ehf
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [October 21, 2021, 5:05pm UTC](https://discuss.elastic.co/t/geoip-filter-in-logstash-with-index-template-not-creating-geo-point-object-as-expected/286768/5 "2021-10-21T17:05:10Z")
It won't work with this mapping, it is wrong.
It should be:
```auto
"mappings": {
"properties" : {
"geo": {
"properties": {
"location": {
"type": "geo_point"
}
}
}
}
}
```
You have a json object named `geoip` with a field named `location`, kibana will show this as `geoip.location`.
Using `geoip.location` in your mapping means that you have a field named `geoip.location`, where the `.` is a literal dot, not a json object flattened.
---
### Author:  [@ehfdub](https://discuss.elastic.co/u/ehfdub)
#### Post date: [October 22, 2021, 3:34pm UTC](https://discuss.elastic.co/t/geoip-filter-in-logstash-with-index-template-not-creating-geo-point-object-as-expected/286768/6 "2021-10-22T15:34:40Z")
Thanks @leandrojmp.
Is there anything I need to do other than refresh the index in Kibana to get the `geo_point` type to show up correctly? It still shows up as two separate `float` fields rather than a `geo\_point.'
I created the template using Kibana devtools:
```auto
{
"my_template" : {
"order" : 0,
"index_patterns" : [
"*"
],
"settings" : { },
"mappings" : {
"properties" : {
"geo" : {
"properties" : {
"location" : {
"type" : "geo_point"
}
}
}
}
},
"aliases" : { }
}
}
```
I waited for a new index to be created and verified that the `geo_point` mapping was created correctly in that new index under the `geoip.location` field.
```auto
"geoip": {
"properties": {
"city_name": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"continent_code": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"country_code2": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"country_code3": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"country_name": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"dma_code": {
"type": "long"
},
"ip": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"latitude": {
"type": "float"
},
"location": {
"type": "geo_point"
},
"longitude": {
"type": "float"
},
"postal_code": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"region_code": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"region_name": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"timezone": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
```
But viewing Kibana Analytics | Discover still shows the `float` fields
One thought: Is it okay to keep older indice which were created before this new index mapping was created? (do those older indice have to be deleted?)
Thanks,
Ehf
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 19, 2021, 3:35pm UTC](https://discuss.elastic.co/t/geoip-filter-in-logstash-with-index-template-not-creating-geo-point-object-as-expected/286768/7 "2021-11-19T15:35:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.