# How do i make mapping for geo\_point?

**URL:** <https://discuss.elastic.co/t/how-do-i-make-mapping-for-geo-point/62139>\
**Category:** Logstash\
**Created:** [October 4, 2016, 10:28am UTC](https://discuss.elastic.co/t/how-do-i-make-mapping-for-geo-point/62139 "2016-10-04T10:28:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tal\_Bar\_Or](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tal_bar_or/32/5127_2.png) [@Tal\_Bar\_Or](https://discuss.elastic.co/u/Tal_Bar_Or)\
**Post date:** [October 4, 2016, 10:28am UTC](https://discuss.elastic.co/t/how-do-i-make-mapping-for-geo-point/62139/1 "2016-10-04T10:28:40Z")

</div>

Hello,

I am using Logstash to index (index name "ids\_sensors")Snort syslog events to Elsticsearch , all seems to work fine  
In the logstash I have following input regarding "Geioip " input below , the stdout of log stash looks below ,  
When i am trying to visualize in Kibana world map events i get

```
  > No Compatible Fields: The "ids_sensors" index pattern does not contain any of the following field types: geo_point

```

i probably missed something , any Idea ?  
Please advice

```
 geoip {
      source => "[SrcIp]"
      target => "SrcGeo"
      
    }
      
    geoip {
      source => "[DstIp]"
      target => "DstGeo"
          
    }

{
            "@version" => "1",
          "@timestamp" => "2016-09-27T20:13:26.483Z",
                "type" => "snort",
                "host" => "172.17.37.2",
          "msg_source" => "SNORTIDS",
                 "msg" => "ALERT",
         "sensor_name" => "sntlv_lan_ips",
     "event_timestamp" => "2016-09-27 23:13:25.284+003",
      "event_priority" => 1,
                 "gid" => "1",
                 "sid" => "2012247",
                 "rev" => "2",
   "alert_description" => "ET P2P BTWebClient UA uTorrent in use ",
      "classification" => "policy-violation",
            "protocol" => "TCP",
               "SrcIp" => "172.17.37.15",
               "DstIp" => "80.94.76.5",
             "SrcPort" => 55309,
             "DstPort" => 80,
              "DstGeo" => {
                "ip" => "80.94.76.5",
     "country_code2" => "NL",
     "country_code3" => "NLD",
      "country_name" => "Netherlands",
    "continent_code" => "EU",
          "latitude" => 52.5,
         "longitude" => 5.75,
          "timezone" => "Europe/Amsterdam",
          "location" => [
        [0] 5.75,
        [1] 52.5
    ],
       "coordinates" => [
        [0] 5.75,
        [1] 52.5
    ]
},
                "tags" => [
    [0] "_grokparsefailure"
],
            "category" => nil,
           "rule_type" => "Emerging Threats",
            "severity" => "High",
   "ET_Signature_Info" => "http://doc.emergingthreats.net/2012247",
"Snort_Signature_Info" => "https://www.snort.org/search?query=1-2012247"

```

}  
{  
"@version" =\> "1",  
"@timestamp" =\> "2016-09-27T20:13:26.483Z",  
"type" =\> "snort",  
"host" =\> "172.17.37.2",  
"msg\_source" =\> "SNORTIDS",  
"msg" =\> "ALERT",  
"sensor\_name" =\> "sntlv\_lan\_ips",  
"event\_timestamp" =\> "2016-09-27 23:13:25.413+003",  
"event\_priority" =\> 1,  
"gid" =\> "1",  
"sid" =\> "2012247",  
"rev" =\> "2",  
"alert\_description" =\> "ET P2P BTWebClient UA uTorrent in use ",  
"classification" =\> "policy-violation",  
"protocol" =\> "TCP",  
"SrcIp" =\> "172.17.37.15",  
"DstIp" =\> "173.254.195.58",  
"SrcPort" =\> 55308,  
"DstPort" =\> 80,  
"DstGeo" =\> {  
"ip" =\> "173.254.195.58",  
"country\_code2" =\> "US",  
"country\_code3" =\> "USA",  
"country\_name" =\> "United States",  
"continent\_code" =\> "NA",  
"region\_name" =\> "CA",  
"city\_name" =\> "Los Angeles",  
"postal\_code" =\> "90014",  
"latitude" =\> 34.043800000000005,  
"longitude" =\> -118.2512,  
"dma\_code" =\> 803,  
"area\_code" =\> 213,  
"timezone" =\> "America/Los\_Angeles",  
"real\_region\_name" =\> "California",  
"location" =\> [  
[0] -118.2512,  
[1] 34.043800000000005  
],  
"coordinates" =\> [  
[0] -118.2512,  
[1] 34.043800000000005  
]  
},  
"tags" =\> [  
[0] "\_grokparsefailure"  
],

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 5, 2016, 10:12am UTC](https://discuss.elastic.co/t/how-do-i-make-mapping-for-geo-point/62139/2 "2016-10-05T10:12:04Z")

</div>

You will need to adapt the Logstash basic template and use that - [https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/master/lib/logstash/outputs/elasticsearch/elasticsearch-template-es2x.json](https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/master/lib/logstash/outputs/elasticsearch/elasticsearch-template-es2x.json)

---

<div class="post-metadata">

**Author:** ![Tal\_Bar\_Or](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tal_bar_or/32/5127_2.png) [@Tal\_Bar\_Or](https://discuss.elastic.co/u/Tal_Bar_Or)\
**Post date:** [October 9, 2016, 1:24pm UTC](https://discuss.elastic.co/t/how-do-i-make-mapping-for-geo-point/62139/3 "2016-10-09T13:24:41Z")

</div>

Thanks Warkolm for the answer,  
Sorry but i am newbie with ELK ,Can you show me example how to adapt the Logstash basic template ?  
Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:35am UTC](https://discuss.elastic.co/t/how-do-i-make-mapping-for-geo-point/62139/4 "2017-07-06T04:35:02Z")

</div>