# Geoip.location not showing in Kibana

**URL:** https://discuss.elastic.co/t/geoip-location-not-showing-in-kibana/175130
**Category:** Logstash
**Tags:** elastic-stack-graph
**Created:** [April 3, 2019, 8:10am UTC](https://discuss.elastic.co/t/geoip-location-not-showing-in-kibana/175130 "2019-04-03T08:10:13Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![miles2smiles](https://avatars.discourse-cdn.com/v4/letter/m/46a35a/32.png) [@miles2smiles](https://discuss.elastic.co/u/miles2smiles)
#### Post date: [April 3, 2019, 8:10am UTC](https://discuss.elastic.co/t/geoip-location-not-showing-in-kibana/175130/1 "2019-04-03T08:10:13Z")

</div>

I am trying to create tile map but I am getting error " **No Compatible Fields:** The prod-\* index pattern does not contain any of the following field types: geo\_point"

Below is my logstash config file.

```auto
input {
 rabbitmq {
        host => "rabbitmq1"
        queue => "Logs"
        heartbeat => 30
        durable => true
        password => "xxxx"
        user => "logstash"
        vhost => "logs"
        tags => "prod"
    }
}
filter {
  geoip { source => ip }
  useragent { source => userAgent }
}
output {
if "prod" in [tags] {
        elasticsearch {
        hosts => ["localhost"]
        index => "prod-%{+YYYY.MM.dd}" }
}
}
```

Below is the output from Elasticsearch Query.

```
      "ip" : "83.110.55.111 ",
      "geoip" : {
        "region_name" : "Ash Shariqah",
        "region_code" : "SH",
        "ip" : "83.110.55.111",
        "country_name" : "United Arab Emirates",
        "country_code2" : "AE",
        "latitude" : 25.3573,
        "longitude" : 55.4033,
        "continent_code" : "AS",
        "country_code3" : "AE",
        "timezone" : "Asia/Dubai",
        "city_name" : "Sharjah",
        "location" : {
          "lon" : 55.4033,
          "lat" : 25.3573
        }
      },
      "logTime" : "03/Apr/2019:04:23:15 +0000",

```

=======================================================

 ![22%20PM](https://us1.discourse-cdn.com/elastic/original/3X/2/5/252e0e741957a6398e9e6bd9c9657e9c7f8ca210.png)

I can see Geoop.location in the JSON view of Kibana but not in Table View,

![22%20PM](https://us1.discourse-cdn.com/elastic/original/3X/5/8/5892047aed351d019c947fdafef5a05b1fa1d874.png)

I am using the default elasticsearch-template

```auto
{
  "template" : "logstash-*",
  "version" : 60001,
  "settings" : {
    "index.refresh_interval" : "5s"
  },
  "mappings" : {
    "_default_" : {
      "dynamic_templates" : [ {
        "message_field" : {
          "path_match" : "message",
          "match_mapping_type" : "string",
          "mapping" : {
            "type" : "text",
            "norms" : false
          }
        }
      }, {
        "string_fields" : {
          "match" : "*",
          "match_mapping_type" : "string",
          "mapping" : {
            "type" : "text", "norms" : false,
            "fields" : {
              "keyword" : { "type": "keyword", "ignore_above": 256 }
            }
          }
        }
      } ],
      "properties" : {
        "@timestamp": { "type": "date"},
        "@version": { "type": "keyword"},
        "geoip" : {
          "dynamic": true,
          "properties" : {
            "ip": { "type": "ip" },
            "location" : { "type" : "geo_point" },
            "latitude" : { "type" : "half_float" },
            "longitude" : { "type" : "half_float" }
          }
        }
      }
    }
  }
}
```

Below are the logs from Logstash.

```auto
[2019-04-03T11:35:04,687][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=>"http://localhost:9200/"}
[2019-04-03T11:35:04,703][INFO][logstash.outputs.elasticsearch] ES Output version determined {:es_version=>6}
[2019-04-03T11:35:04,703][WARN][logstash.outputs.elasticsearch] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>6}
[2019-04-03T11:35:04,720][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["//localhost"]}
[2019-04-03T11:35:04,721][INFO][logstash.outputs.elasticsearch] Using default mapping template
[2019-04-03T11:35:04,724][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage_template=>{"template"=>"logstash-*", "version"=>60001, "settings"=>{"index.refresh_interval"=>"5s"}, "mappings"=>{"_default_"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}}
[2019-04-03T11:35:04,776][INFO][logstash.filters.geoip] Using geoip database {:path=>"/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-5.0.3-java/vendor/GeoLite2-City.mmdb"}
[2019-04-03T11:35:05,221][INFO][logstash.filters.geoip] Using geoip database {:path=>"/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-5.0.3-java/vendor/GeoLite2-City.mmdb"}
[2019-04-03T11:35:05,530][INFO][logstash.pipeline] Pipeline started successfully {:pipeline_id=>"main", :thread=>"#<Thread:0x49818e8c run>"}
[2019-04-03T11:35:05,695][INFO][logstash.agent] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[2019-04-03T11:35:06,143][INFO][logstash.inputs.rabbitmq] Connected to RabbitMQ at
[2019-04-03T11:35:06,148][INFO][logstash.inputs.rabbitmq] Connected to RabbitMQ at
[2019-04-03T11:35:06,551][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}
```

I've tried the following.

1. Delete and re-create Index ( from kibana )
2. Delete and re-index Index ( from Elasticsearch)
3. Re-freshed fields from Kibana for index.

Anything I am missing here?

---

<div class="post-metadata">

### Author: ![miles2smiles](https://avatars.discourse-cdn.com/v4/letter/m/46a35a/32.png) [@miles2smiles](https://discuss.elastic.co/u/miles2smiles)
#### Post date: [April 7, 2019, 11:11am UTC](https://discuss.elastic.co/t/geoip-location-not-showing-in-kibana/175130/2 "2019-04-07T11:11:20Z")

</div>

Any update on this please ?

---

<div class="post-metadata">

### Author: ![staodd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/staodd/32/24509_2.png) [@staodd](https://discuss.elastic.co/u/staodd)
#### Post date: [April 7, 2019, 2:18pm UTC](https://discuss.elastic.co/t/geoip-location-not-showing-in-kibana/175130/3 "2019-04-07T14:18:57Z")

</div>

At least reformat your post so it's readable. Please read the help about how to post code.

Saves everyone a lot of time if the post is properly formatted.

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [April 7, 2019, 2:34pm UTC](https://discuss.elastic.co/t/geoip-location-not-showing-in-kibana/175130/4 "2019-04-07T14:34:43Z")

</div>

The default Logstash template only applies to indices that match the pattern ‘Logstash-•’ which your index does not. Either update the existing template, add a new that matches your index or simply rename your index.

---

<div class="post-metadata">

### Author: ![miles2smiles](https://avatars.discourse-cdn.com/v4/letter/m/46a35a/32.png) [@miles2smiles](https://discuss.elastic.co/u/miles2smiles)
#### Post date: [April 15, 2019, 6:52am UTC](https://discuss.elastic.co/t/geoip-location-not-showing-in-kibana/175130/5 "2019-04-15T06:52:29Z")

</div>

Sorry for that fixed it now.

---

<div class="post-metadata">

### Author: ![miles2smiles](https://avatars.discourse-cdn.com/v4/letter/m/46a35a/32.png) [@miles2smiles](https://discuss.elastic.co/u/miles2smiles)
#### Post date: [April 15, 2019, 6:54am UTC](https://discuss.elastic.co/t/geoip-location-not-showing-in-kibana/175130/6 "2019-04-15T06:54:33Z")

</div>

HI Christian,

My logs are JSON object and we modify fields / parameters as needed, if I define a new template do I need to specify all the fields or key fields such as IP ?

If I copy the same template and rename it to match my index name will it still work ?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 13, 2019, 6:54am UTC](https://discuss.elastic.co/t/geoip-location-not-showing-in-kibana/175130/7 "2019-05-13T06:54:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
