Geoip.location


(Will) #1

If geoip.location appears in the index as a geo_point, why am I unable to use it in a heat map? Also, why do geoip.longitude and geoip.latitude appear as numbers? Shouldn't they by default be float?

I have a mapping like this:
PUT _template/syslog
{
"template": "syslog*",
"mappings": {
"eventGeoLocations": {
"properties": {
"src_geo_location": { "type": "geo_point" },
"geoip.latitude": { "type": "float" },
"geoip.longitude": { "type": "float" }
}
}
}
}

I also have a very basic geoip config section.
#GeoIP
if [IN] == "eno1" {
geoip {
source => "src_IP"
}
mutate { convert => {"geoip.latitude" => "float"} }
mutate { convert => {"geoip.longitude" => "float"} }
#mutate { add_field => { "src_geo_location" => "geoip.latitude,geoip.longtude" } } #not working
} # close if


Geo_point is not getting mapped correctly
(Mark Walkom) #2

Did you change the document_type to match this?


(Will) #3

Not sure what you so mean that likely means no..


(Will) #4

I think I am failing to grasp the mappings template file. I will re read.


(Mark Walkom) #5

It's not immediately clear, but the eventGeoLocations you have there is the _type of the document, so it needs to match.

Logstash uses logs as the default, so unless you are setting that it's probably the cause.


(Will) #6

I was under the impression that was more or less a tag. I did get this to work while on another little project where I converted the two number fields to float, created a geo_point field, and stuck the two converted fields together. I was trying to replicate that here.
I am really new at this. thx for the help


(Will) #7

I do that is _type in the docs. https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html

Where are the _type listed out so I can pick the correct one? I think I got luck with the other thing..


(Mark Walkom) #8

Change;

to;

The difference is the use of _default_, which will apply this to any type by default.


(Will) #9

No use- I am still confused why the default geoip fields have the wrong data types to either use directly in a coordinate map or allow conversion to a geo_point.


(Will) #10

geoip.location geo_point Is the correct data type for the coordinate map!! Why is it missing from the dropdown in Kibana?


(Will) #11

geoip.location shows up as an option when I use the logstash-index. What am I missing?


(Magnus Bäck) #12

geoip.location geo_point Is the correct data type for the coordinate map!!

Is it? What do the actual mappings of the index look like? Use the get mapping API.


(Will) #13

I destroyed the other index when this worked with the logstash index. I was relying on what Kibana was showing in the index vie, and I pasted from the view into this discussion. I should have been more clear where I was seeing the geoip.location referenced as a geo_point.
I will use the mapping api from now on when I have issue with mappings.


(system) #14

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.