# Help with ELK and geo\_point for Filebeat

**URL:** <https://discuss.elastic.co/t/help-with-elk-and-geo-point-for-filebeat/154249>\
**Category:** Logstash\
**Created:** [October 26, 2018, 7:01pm UTC](https://discuss.elastic.co/t/help-with-elk-and-geo-point-for-filebeat/154249 "2018-10-26T19:01:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lee\_Lilleorg-Meilleu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lee_lilleorg-meilleu/32/47953_2.png) [@Lee\_Lilleorg-Meilleu](https://discuss.elastic.co/u/Lee_Lilleorg-Meilleu)\
**Post date:** [October 26, 2018, 7:01pm UTC](https://discuss.elastic.co/t/help-with-elk-and-geo-point-for-filebeat/154249/1 "2018-10-26T19:01:37Z")

</div>

Hi, I have an ELK setup

with Filebeat -\> Redis -\> Logstash -\> Elasticsearch using the latest 6.X.

I have scoured the net about the cryptic geo\_point type (that won't let me make a coordinate map)

I have my indexes created as "filebeat-\*" but am unsure where these are created.

What can I type into the console to apply the geo\_point stuff to the filebeat indexes?

Is this being auto gen'ed in file beat (on the Client) or at the Logstash point.

Heres my Filter:

filter {  
if [source] =~ "access" {  
grok {  
patterns\_dir =\> ["/etc/logstash/patterns"]  
match =\> { "message" =\> "%{NGINX\_ACCESS}" }  
overwrite =\> ["message"]  
}  
useragent {  
source =\> "http\_user\_agent"  
}  
geoip {  
source =\> "remote\_addr"  
target =\> "geoip"  
}  
}  
else if [source] =~ "error" {  
grok {  
patterns\_dir =\> ["/etc/logstash/patterns"]  
match =\> { "message" =\> "%{NGINX\_ACCESS}" }

}  
}  
}

output {  
elasticsearch { hosts =\> ["xx.xxx.xxx.xx:9200"]  
hosts =\> "xx.xxx.xxx.xx:9200"  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"

}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 23, 2018, 7:01pm UTC](https://discuss.elastic.co/t/help-with-elk-and-geo-point-for-filebeat/154249/2 "2018-11-23T19:01:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.