# Geoip.location not Auto Generated

**URL:** https://discuss.elastic.co/t/geoip-location-not-auto-generated/257935
**Category:** Kibana
**Tags:** maps
**Created:** [December 8, 2020, 5:28am UTC](https://discuss.elastic.co/t/geoip-location-not-auto-generated/257935 "2020-12-08T05:28:22Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![Boris\_Joseph](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/boris_joseph/32/76499_2.png) [@Boris\_Joseph](https://discuss.elastic.co/u/Boris_Joseph)
#### Post date: [December 8, 2020, 5:28am UTC](https://discuss.elastic.co/t/geoip-location-not-auto-generated/257935/1 "2020-12-08T05:28:22Z")

</div>

hi,

I am shipping & Parsing access logs for Apache webserver using beats and logstash.

Added webUserID as source for GeoIP in logstash and refreshed index pattern.  
But geoip.location with geoPoint datatype is not showing up in the index fields(all other geoip fields are).

Not using any index templates. And Logstash creates Index everyday based on date regex.

Can anyone help figure out why geoip.location with geoPoint datatype is not auto-generated?

Should i add a custom field in geoIP via logstash combining geopi.lat +geoip.lon and create index template mapping custom field as geo\_point type?

#################  
Logstash GeoIP Config  
#################  
'_geoip{_

- source =\> "webUserID"\*  
_}_'

###############  
Index Mapping  
###############  
'_"geoip": {_

- 

```
     "properties": { *

```

- 

```
       "latitude": {*

```

- 

```
         "type": "float"*

```

- 

```
       },*

```

- 

```
       "location": {*

```

- 

```
         "properties": {*

```

- 

```
           "lat": {*

```

- 

```
             "type": "float"*

```

- 

```
           },*

```

- 

```
           "lon": {*

```

- 

```
             "type": "float"*

```

- 

```
           }*

```

- 

```
         }*

```

- 

```
       },*

```

- 

```
       "longitude": {*

```

- 

```
         "type": "float"*

```

- 

```
       } *

```

- 

```
     }*

```

- 

```
   }*'

```

###############  
Kibana Discover  
###############

 ![GeoKibana](https://us1.discourse-cdn.com/elastic/original/3X/b/8/b856956bdcb01b6c455f6ecd9983c4723a223672.png)

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [December 8, 2020, 6:49am UTC](https://discuss.elastic.co/t/geoip-location-not-auto-generated/257935/2 "2020-12-08T06:49:40Z")

</div>

> [@Boris\_Joseph](#):
>
> Not using any index templates.

That is likely why, you need to set it as a a geopoint in a template.

---

<div class="post-metadata">

### Author: ![Boris\_Joseph](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/boris_joseph/32/76499_2.png) [@Boris\_Joseph](https://discuss.elastic.co/u/Boris_Joseph)
#### Post date: [December 8, 2020, 8:05am UTC](https://discuss.elastic.co/t/geoip-location-not-auto-generated/257935/3 "2020-12-08T08:05:15Z")

</div>

> [@warkolm](#):
>
> likely why, you need to set it as a a geopoint in a template

Ok. Will try with template and check results.

Just frustrated that ES can't identify/construct geoip.location with geopoint data type., when geoip.location.lat and geoip.location.lon is already present.

Extra step to define/modify geoip fields, just breaks the illusion of single config model for geoip.

---

<div class="post-metadata">

### Author: ![Boris\_Joseph](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/boris_joseph/32/76499_2.png) [@Boris\_Joseph](https://discuss.elastic.co/u/Boris_Joseph)
#### Post date: [December 9, 2020, 4:46am UTC](https://discuss.elastic.co/t/geoip-location-not-auto-generated/257935/4 "2020-12-09T04:46:21Z")

</div>

defined index template as follows and got below error.  
Any clue?

 ![template_mapping_error](https://us1.discourse-cdn.com/elastic/original/3X/1/7/17de2af32a168cd14548e726fff6854e730ef8ef.png)

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [December 9, 2020, 9:21pm UTC](https://discuss.elastic.co/t/geoip-location-not-auto-generated/257935/5 "2020-12-09T21:21:42Z")

</div>

Kibana doesn't like to mix mapping types. If you want it fixed you will want to reindex the old data, or just delete it if it's not important.

---

<div class="post-metadata">

### Author: ![Boris\_Joseph](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/boris_joseph/32/76499_2.png) [@Boris\_Joseph](https://discuss.elastic.co/u/Boris_Joseph)
#### Post date: [December 10, 2020, 6:45am UTC](https://discuss.elastic.co/t/geoip-location-not-auto-generated/257935/6 "2020-12-10T06:45:00Z")

</div>

Added a custom field in geoip combining latitude and longitude in logsatsh.

Defined index template with custom field defined as geopoint.

And deleted old indexes and refreshed index pattern.  
Worked.

Though I still think that when adding geoip to logstash first time, and refreshing existing index pattern, should auto identify geoip.location as geopoint type; since field would be generated for the first time; even though indices may already exist.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 7, 2021, 6:45am UTC](https://discuss.elastic.co/t/geoip-location-not-auto-generated/257935/7 "2021-01-07T06:45:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
