# GeoIP lat lon fields are always number inspite of mapping it to float

**URL:** <https://discuss.elastic.co/t/geoip-lat-lon-fields-are-always-number-inspite-of-mapping-it-to-float/158040>\
**Category:** Elasticsearch\
**Created:** [November 23, 2018, 4:51pm UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-always-number-inspite-of-mapping-it-to-float/158040 "2018-11-23T16:51:04Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![prakas](https://avatars.discourse-cdn.com/v4/letter/p/eb9ed0/32.png) [@prakas](https://discuss.elastic.co/u/prakas)\
**Post date:** [November 23, 2018, 4:51pm UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-always-number-inspite-of-mapping-it-to-float/158040/1 "2018-11-23T16:51:04Z")

</div>

My Mapping is as follows:  
{  
"mapping": {  
"doc": {  
"properties": {  
"@timestamp": {  
"type": "date"  
},  
"@version": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"clientip": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"device": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"geoip": {  
"properties": {  
"continent\_code": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"coordinates": {  
"type": "geo\_point"  
},  
"country\_code2": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"country\_code3": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"country\_name": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"ip": {  
"type": "ip"  
},  
"latitude": {  
"type": "half\_float"  
},  
"location": {  
"type": "geo\_point"  
},  
"longitude": {  
"type": "half\_float"  
},  
"timezone": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
}  
}  
},  
"host": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"loglevel": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"message": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"module": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"pid": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"syslog\_message": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"tags": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"timestamp": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
}  
}  
}  
}  
}

My filter settings:  
filter {  
grok {  
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:device} %{DATA:module}(?:[%{POSINT:pid}])?: %{GREEDYDATA:message}" }  
overwrite =\> ["message"]  
}  
grok {  
match =\> { "message" =\> [  
"[%{LOGLEVEL:loglevel}%{SPACE}] %{GREEDYDATA:syslog\_message}",  
"level=%{WORD:loglevel} %{GREEDYDATA:syslog\_message}",  
"%{IP:clientip}",  
"%{GREEDYDATA:syslog\_message}"  
]}  
}  
geoip {  
source =\> "clientip"

# database =\> "/etc/logstash/GeoLiteCity.data"

```
target => "geoip"
add_tag => ["geoip"]
add_field => ["[geoip][coordinates]","%{[geoip][longitude]}"]
add_field => ["[geoip][coordinates]","%{[geoip][latitude]}"]

```

}  
mutate {  
convert =\> ["[geoip][coordinates]","float"]  
}  
}

Because lat,lon is always numbers the plotting on the map is in wrong position.  
Please help resolve this.

Many Thanks!

---

<div class="post-metadata">

**Author:** ![Magnus\_Kessler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnus_kessler/32/42001_2.png) [@Magnus\_Kessler](https://discuss.elastic.co/u/Magnus_Kessler)\
**Post date:** [November 23, 2018, 5:48pm UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-always-number-inspite-of-mapping-it-to-float/158040/2 "2018-11-23T17:48:48Z")

</div>

Your mapping has

> [@prakas](#):
>
> ```auto
> "coordinates": {
> "type": "geo_point"
> },
> 
> ```

which is the recommended way to map geo coordinates. The logstash `geoip` plugin will create a `location` field, that is correctly formatted for a `geo_point` field.

I suggest you keep the `geoip` filter configuration simple, and don't try to override the coordinates from `longitude` and `latitude`. If needed, you could rename `location` to `coordinates` instead, or simply change your queries / visualisations to use the `location` field.

---

<div class="post-metadata">

**Author:** ![prakas](https://avatars.discourse-cdn.com/v4/letter/p/eb9ed0/32.png) [@prakas](https://discuss.elastic.co/u/prakas)\
**Post date:** [November 23, 2018, 5:54pm UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-always-number-inspite-of-mapping-it-to-float/158040/3 "2018-11-23T17:54:11Z")

</div>

> [@prakas](#):
>
> nvert =\> ["[geoip][coordinates]","float"]

Thanks for the response!  
I tried with the filter:  
filter {  
grok {  
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:device} %{DATA:module}(?:[%{POSINT:pid}])?: %{GREEDYDATA:message}" }  
overwrite =\> ["message"]  
}  
grok {  
match =\> { "message" =\> [  
"[%{LOGLEVEL:loglevel}%{SPACE}] %{GREEDYDATA:syslog\_message}",  
"level=%{WORD:loglevel} %{GREEDYDATA:syslog\_message}",  
"%{IP:clientip}",  
"%{GREEDYDATA:syslog\_message}"  
]}  
}  
geoip {  
source =\> "clientip"  
}  
}

Issue is that the lat/lon fields are always numbers and not floats. For example an ip of 14.143.35.10 results in lat:20, lon:77 whereas the actual values should have been lat:20.9833, lon:77.5833.

Please help.

---

<div class="post-metadata">

**Author:** ![prakas](https://avatars.discourse-cdn.com/v4/letter/p/eb9ed0/32.png) [@prakas](https://discuss.elastic.co/u/prakas)\
**Post date:** [November 26, 2018, 10:04am UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-always-number-inspite-of-mapping-it-to-float/158040/4 "2018-11-26T10:04:48Z")

</div>

> [@prakas](#):
>
> For example an ip of 14.143.35.10 results in lat:20, lon:77 whereas the actual values should have been lat:20.9833, lon:77.5833.

Any other suggestions to try out?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 24, 2018, 10:05am UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-always-number-inspite-of-mapping-it-to-float/158040/5 "2018-12-24T10:05:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.