Geoip.location

Elastic Stack Logstash
1

If geoip.location appears in the index as a geo_point, why am I unable to use it in a heat map? Also, why do geoip.longitude and geoip.latitude appear as numbers? Shouldn't they by default be float?

I have a mapping like this:
PUT _template/syslog
{
"template": "syslog*",
"mappings": {
"eventGeoLocations": {
"properties": {
"src_geo_location": { "type": "geo_point" },
"geoip.latitude": { "type": "float" },
"geoip.longitude": { "type": "float" }
}
}
}
}

I also have a very basic geoip config section.
#GeoIP
if [IN] == "eno1" {
geoip {
source => "src_IP"
}
mutate { convert => {"geoip.latitude" => "float"} }
mutate { convert => {"geoip.longitude" => "float"} }
#mutate { add_field => { "src_geo_location" => "geoip.latitude,geoip.longtude" } } #not working
} # close if

2

Did you change the document_type to match this?

3

Not sure what you so mean that likely means no..

4

I think I am failing to grasp the mappings template file. I will re read.

5

It's not immediately clear, but the eventGeoLocations you have there is the _type of the document, so it needs to match.

Logstash uses logs as the default, so unless you are setting that it's probably the cause.

6

I was under the impression that was more or less a tag. I did get this to work while on another little project where I converted the two number fields to float, created a geo_point field, and stuck the two converted fields together. I was trying to replicate that here.
I am really new at this. thx for the help

7

I do that is _type in the docs. https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html

Where are the _type listed out so I can pick the correct one? I think I got luck with the other thing..

8

Change;

to;

The difference is the use of _default_, which will apply this to any type by default.

9

No use- I am still confused why the default geoip fields have the wrong data types to either use directly in a coordinate map or allow conversion to a geo_point.

10

geoip.location geo_point Is the correct data type for the coordinate map!! Why is it missing from the dropdown in Kibana?

11

geoip.location shows up as an option when I use the logstash-index. What am I missing?

12

geoip.location geo_point Is the correct data type for the coordinate map!!

Is it? What do the actual mappings of the index look like? Use the get mapping API.

13

I destroyed the other index when this worked with the logstash index. I was relying on what Kibana was showing in the index vie, and I pasted from the view into this discussion. I should have been more clear where I was seeing the geoip.location referenced as a geo_point.
I will use the mapping api from now on when I have issue with mappings.

14

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.