I use Filebeats, Logstash and Elasticsearch to parse differents types of logs files ( IIS, Syslog, Apache, ... ) and watch the result with Kibana. I want to add a map on my dashboard so I use geoip to get gps coordinates from an ip address but sometimes (to set an example : with syslog log file) I only have the username and not the ip address. In result only a part of my output data have the geoip field but i want to define geoip.location as a geopoint in my template. Can i just set the type of the field:"location" on geo_point even if the field is not common to all the output ?
Thank you in advance for your answer