# Geoip.location
**URL:** https://discuss.elastic.co/t/geoip-location/95632
**Category:** Logstash
**Created:** [August 3, 2017, 3:11am UTC](https://discuss.elastic.co/t/geoip-location/95632 "2017-08-03T03:11:55Z")
**Posts on this page:** 14
**Page:** 1
### Author:  [@elaair](https://discuss.elastic.co/u/elaair)
#### Post date: [August 3, 2017, 3:11am UTC](https://discuss.elastic.co/t/geoip-location/95632/1 "2017-08-03T03:11:55Z")
If geoip.location appears in the index as a geo\_point, why am I unable to use it in a heat map? Also, why do geoip.longitude and geoip.latitude appear as numbers? Shouldn't they by default be float?
I have a mapping like this:
PUT \_template/syslog
{
"template": "syslog\*",
"mappings": {
"eventGeoLocations": {
"properties": {
"src\_geo\_location": { "type": "geo\_point" },
"geoip.latitude": { "type": "float" },
"geoip.longitude": { "type": "float" }
}
}
}
}
I also have a very basic geoip config section.
#GeoIP
if [IN] == "eno1" {
geoip {
source =\> "src\_IP"
}
mutate { convert =\> {"geoip.latitude" =\> "float"} }
mutate { convert =\> {"geoip.longitude" =\> "float"} }
#mutate { add\_field =\> { "src\_geo\_location" =\> "geoip.latitude,geoip.longtude" } } #not working
} # close if
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 3, 2017, 3:24am UTC](https://discuss.elastic.co/t/geoip-location/95632/2 "2017-08-03T03:24:54Z")
> [@elaair](#):
>
> eventGeoLocations
Did you change the `document_type` to match this?
---
### Author:  [@elaair](https://discuss.elastic.co/u/elaair)
#### Post date: [August 3, 2017, 3:28am UTC](https://discuss.elastic.co/t/geoip-location/95632/3 "2017-08-03T03:28:20Z")
Not sure what you so mean that likely means no..
---
### Author:  [@elaair](https://discuss.elastic.co/u/elaair)
#### Post date: [August 3, 2017, 3:29am UTC](https://discuss.elastic.co/t/geoip-location/95632/4 "2017-08-03T03:29:19Z")
I think I am failing to grasp the mappings template file. I will re read.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 3, 2017, 3:31am UTC](https://discuss.elastic.co/t/geoip-location/95632/5 "2017-08-03T03:31:11Z")
It's not immediately clear, but the `eventGeoLocations` you have there is the `_type` of the document, so it needs to match.
Logstash uses [`logs`](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-document_type) as the default, so unless you are setting that it's probably the cause.
---
### Author:  [@elaair](https://discuss.elastic.co/u/elaair)
#### Post date: [August 3, 2017, 3:34am UTC](https://discuss.elastic.co/t/geoip-location/95632/6 "2017-08-03T03:34:25Z")
I was under the impression that was more or less a tag. I did get this to work while on another little project where I converted the two number fields to float, created a geo\_point field, and stuck the two converted fields together. I was trying to replicate that here.
I am really new at this. thx for the help
---
### Author:  [@elaair](https://discuss.elastic.co/u/elaair)
#### Post date: [August 3, 2017, 3:37am UTC](https://discuss.elastic.co/t/geoip-location/95632/7 "2017-08-03T03:37:28Z")
I do that is \_type in the docs. [https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html)
Where are the \_type listed out so I can pick the correct one? I think I got luck with the other thing..
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 3, 2017, 3:48am UTC](https://discuss.elastic.co/t/geoip-location/95632/8 "2017-08-03T03:48:26Z")
Change;
> [@elaair](#):
>
> “template”: “syslog\*”,
> “mappings”: {
> “eventGeoLocations”: {
> “properties”: {
to;
> [@elaair](#):
>
> ```auto
> “template”: “syslog*”,
> “mappings”: {
> “_default_”: {
> “properties”: {
>
> ```
The difference is the use of `_default_`, which will apply this to any type by default.
---
### Author:  [@elaair](https://discuss.elastic.co/u/elaair)
#### Post date: [August 3, 2017, 9:37pm UTC](https://discuss.elastic.co/t/geoip-location/95632/9 "2017-08-03T21:37:52Z")
No use- I am still confused why the default geoip fields have the wrong data types to either use directly in a coordinate map or allow conversion to a geo\_point.
---
### Author:  [@elaair](https://discuss.elastic.co/u/elaair)
#### Post date: [August 3, 2017, 9:41pm UTC](https://discuss.elastic.co/t/geoip-location/95632/10 "2017-08-03T21:41:25Z")
geoip.location geo\_point Is the correct data type for the coordinate map!! Why is it missing from the dropdown in Kibana?
---
### Author:  [@elaair](https://discuss.elastic.co/u/elaair)
#### Post date: [August 4, 2017, 12:06am UTC](https://discuss.elastic.co/t/geoip-location/95632/11 "2017-08-04T00:06:29Z")
geoip.location shows up as an option when I use the logstash-index. What am I missing?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 4, 2017, 8:34am UTC](https://discuss.elastic.co/t/geoip-location/95632/12 "2017-08-04T08:34:09Z")
> geoip.location geo\_point Is the correct data type for the coordinate map!!
Is it? What do the actual mappings of the index look like? Use the get mapping API.
---
### Author:  [@elaair](https://discuss.elastic.co/u/elaair)
#### Post date: [August 5, 2017, 3:59am UTC](https://discuss.elastic.co/t/geoip-location/95632/13 "2017-08-05T03:59:35Z")
I destroyed the other index when this worked with the logstash index. I was relying on what Kibana was showing in the index vie, and I pasted from the view into this discussion. I should have been more clear where I was seeing the geoip.location referenced as a geo\_point.
I will use the mapping api from now on when I have issue with mappings.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 2, 2017, 3:59am UTC](https://discuss.elastic.co/t/geoip-location/95632/14 "2017-09-02T03:59:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.