I'm looking to use the geoip.location field but it's not being created. I've found a ton of articles about updating it to a geo_point type but I'm not finding any about the issue of it simply not being created. Odd thing is, every OTHER geoip field is there, just not geoip.location
This is an out of the box, all v. 6.0.1 install: Elasticsearch, Logstash, Filebeat, Metricbeat. Here's what I've done thus far:
- Installed the ES ingest-geoip plugin (and uninstalled and reinstalled)
- Loaded, reloaded, overwritten, deleted, and re-loaded the index template
- Refreshed the index mappings
- Made sure the apache2 module in filebeat is enabled
But all the other geoip fields are there, including geoip.location.lat and geoip.location.lon. Just not the field that combines the two as a geo_point type.
Further puzzling me, in the JSON data I've got:
"agent": ""Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36"",
"city_name": "Chula Vista",
"country_name": "United States",
So then I went back into the filebeat.yml and _source.enable: false is commented out under setup.template.settings - it's not turned off (though if _source was turned off it wouldn't be in the JSON data anyway, I would think.) Anyway, so now I'm kinda stuck.
I've also got:
source => "clientip"
as part of my apache logstash filter.
And I had all this working just fine in a 5.6.4 install on another machine.
Still relatively new to ES and it's components and while I'm fine with things not working - you never learn anything if something doesn't break, I've found - I also know when it's time to ask for help.
Any help would be appreciated!
Thanks in advance!