# Geoip losing type geo\_point for location (v8.1)

**URL:** https://discuss.elastic.co/t/geoip-losing-type-geo-point-for-location-v8-1/299623
**Category:** Elasticsearch
**Created:** [March 14, 2022, 1:20pm UTC](https://discuss.elastic.co/t/geoip-losing-type-geo-point-for-location-v8-1/299623 "2022-03-14T13:20:44Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![fedora35](https://avatars.discourse-cdn.com/v4/letter/f/e9a140/32.png) [@fedora35](https://discuss.elastic.co/u/fedora35)
#### Post date: [March 14, 2022, 1:20pm UTC](https://discuss.elastic.co/t/geoip-losing-type-geo-point-for-location-v8-1/299623/1 "2022-03-14T13:20:44Z")

</div>

Hello,  
I'm a beginner with ELK and i have the following problem:  
I send apache's logs with filebeat to logstash. All is working except the fact when I check the location mapping in kibana, it has no type : it appears like this :

```auto
"location": {
                "properties": {
                  "lat": {
                    "type": "float"
                  },
                  "lon": {
                    "type": "float"
                  }
                }
              }

```

And when I want to create a map, I get the error "no geo\_point" found.

My file for logstash is defined by:

```auto
input {
    beats {
        port => "5044"
        client_inactivity_timeout => "3600"
        ssl => true
        ssl_certificate_authorities => ["/etc/logstash/CA-cert.pem"]
        ssl_certificate => "/etc/logstash/elk-cert.pem"
        ssl_key => "/etc/logstash/elk.pkcs8.key"
        ssl_verify_mode => "force_peer"
    }
}

filter {
if "apache_access" in [tags] {
  grok {
        match => { "message" => "%{HTTPD_COMBINEDLOG}"}
    }
   date {
    match => ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]
  }
  useragent {
    source => "message"
  }
    geoip {
    source => "[source][address]"
    target => "client"
    }                                                                                             
}
if "apache_error" in [tags] {
  grok {
        match => { "message" => "%{HTTPD_ERRORLOG}"}
    }
   date {
    match => ["timestamp" , "EEE MMM dd HH:mm:ss.SSSSSS yyyy"]
  }
    geoip {
        source => "[source][address]"
        target => "client"
    }                                                                                             
}
}

output {

    elasticsearch {
        hosts => ["https://elk.example.com:9200"]
        cacert => "/etc/logstash/CA-cert.pem"
        user => "elastic"
        password => "XXXX"
        index => "logstash-eva-%{+YYYY.MM.dd}"
    }   
     # stdout { codec => rubydebug }                                                            
}

```

For the client sending logs the file /etc/filebeat/filebeat.yml is:

```auto
filebeat.inputs:
- type: filestream
  enabled: true
  paths:
    - /var/log/apache2/*access*log*
    - /var/log/apache2/eva/*access*log*
  tags: ["eva_access","eva","apache","apache_access"]
  prospector.scanner.exclude_files: ['.gz$']

- type: filestream
  enabled: true
  paths:
    - /var/log/apache2/*error*log*
    - /var/log/apache2/eva/*error*log*
  tags: ["eva_error","eva","apache","apache_error"]
  prospector.scanner.exclude_files: ['.gz$']

```

I also run where filebeat is running the command:

```auto
filebeat setup -e --pipelines --index-management --dashboards

```

I read on others topics involving such kind of problems, that index name in logstash output should start by logstash- (i also tried by filebeat- ) but the missing geo\_point is always occuring. (the longitudianl and latitud are correctly filled by geoip).

I really dont' know what i messed up with my configurations. Any ideas how to solve this issue ?

Best regards

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 11, 2022, 1:21pm UTC](https://discuss.elastic.co/t/geoip-losing-type-geo-point-for-location-v8-1/299623/2 "2022-04-11T13:21:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.