# How to check if the field exists before to define him as geoppoint **URL:** \ **Category:** Logstash\ **Created:** [January 13, 2020, 4:32pm UTC](https://discuss.elastic.co/t/how-to-check-if-the-field-exists-before-to-define-him-as-geoppoint/214871 "2020-01-13T16:32:46Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![IneedHelp](https://avatars.discourse-cdn.com/v4/letter/i/eada6e/32.png) [@IneedHelp](https://discuss.elastic.co/u/IneedHelp)\ **Post date:** [January 13, 2020, 4:32pm UTC](https://discuss.elastic.co/t/how-to-check-if-the-field-exists-before-to-define-him-as-geoppoint/214871/1 "2020-01-13T16:32:46Z")
Hello, I use Filebeats, Logstash and Elasticsearch to parse differents types of logs files ( IIS, Syslog, Apache, ... ) and watch the result with Kibana. I want to add a map on my dashboard so I use geoip to get gps coordinates from an ip address but sometimes (to set an example : with syslog log file) I only have the username and not the ip address. In result only a part of my output data have the geoip field but i want to define geoip.location as a geopoint in my template. Can i just set the type of the field:"location" on geo\_point even if the field is not common to all the output ? Thank you in advance for your answer ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 13, 2020, 6:31pm UTC](https://discuss.elastic.co/t/how-to-check-if-the-field-exists-before-to-define-him-as-geoppoint/214871/2 "2020-01-13T18:31:04Z")
Having a template that defines the type of a field does not mean any documents have to contain that field, so you can set the type of an optional field. ---
**Author:** ![IneedHelp](https://avatars.discourse-cdn.com/v4/letter/i/eada6e/32.png) [@IneedHelp](https://discuss.elastic.co/u/IneedHelp)\ **Post date:** [January 14, 2020, 9:50am UTC](https://discuss.elastic.co/t/how-to-check-if-the-field-exists-before-to-define-him-as-geoppoint/214871/3 "2020-01-14T09:50:26Z")
Perfect I thank you ! But my problem isn't solved 😥 i asked this question because when i try to convert geoip.location into a geo\_point it doesn't work ( i tried to find the issue without sucess). I followed this tutorial (and others )[https://www.elastic.co/fr/blog/geoip-in-the-elastic-stack](https://www.elastic.co/fr/blog/geoip-in-the-elastic-stack) i actually use geoip, but if i can't see the location datas on a map, use it seems meaningless to me Do you have any solutions ? ---
**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\ **Post date:** [January 15, 2020, 3:51pm UTC](https://discuss.elastic.co/t/how-to-check-if-the-field-exists-before-to-define-him-as-geoppoint/214871/4 "2020-01-15T15:51:55Z")
Before applying the `geoip` filter on the field `xyz`, check the existence of that field, like: ``` filter { if [xyz] { geoip { source => "xyz" } } } ``` ---
**Author:** ![IneedHelp](https://avatars.discourse-cdn.com/v4/letter/i/eada6e/32.png) [@IneedHelp](https://discuss.elastic.co/u/IneedHelp)\ **Post date:** [January 16, 2020, 7:29am UTC](https://discuss.elastic.co/t/how-to-check-if-the-field-exists-before-to-define-him-as-geoppoint/214871/5 "2020-01-16T07:29:51Z")
Thank you but I already did it. I check the existence of the field and his type ( an ip address ) before to apply geoip. In fact when i set logstash output on stdout{} i get all the information that i want ( like the geoip field ), but when i set logstash output on elacticsearch and use a tempate to define the field as a geo\_point, elasticsearch save it as a number and not a geo\_point so i can't use the map visualization in kibana. This is my current issue. ---
**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\ **Post date:** [January 16, 2020, 10:38am UTC](https://discuss.elastic.co/t/how-to-check-if-the-field-exists-before-to-define-him-as-geoppoint/214871/6 "2020-01-16T10:38:08Z")
Oh got it now. Can you share the template? Are you sure it's been applied to your index (have you created it BEFORE creating the index)? ---
**Author:** ![IneedHelp](https://avatars.discourse-cdn.com/v4/letter/i/eada6e/32.png) [@IneedHelp](https://discuss.elastic.co/u/IneedHelp)\ **Post date:** [January 27, 2020, 3:06pm UTC](https://discuss.elastic.co/t/how-to-check-if-the-field-exists-before-to-define-him-as-geoppoint/214871/7 "2020-01-27T15:06:59Z")
Sorry i'm late In logstash > geoip { > source =\> "clientip" > target =\> "geoip" > } > mutate { > convert =\> { > "[geoip][location][lat]" =\> "float" > "[geoip][location][lon]" =\> "float" > } > } Mutate part is only to be sure that logstash save location as float and not a number My template: > { > "index\_patterns": ["squid-\*"], > "mappings": { > "_default_": { > "properties": { > "clientip": { "type": "ip" }, > "server\_ip": { "type": "ip" }, > "user": { "type": "keyword" }, > "timestamp": { "type": "date" }, > "Log\_File\_Format": { "type": "keyword" }, > "Data\_Sent": { "type": "number" }, > "Data\_Received": { "type": "number" }, > "HTTP\_Result": { "type": "number" }, > "bytes": { "type": "number" }, > "delay": { "type": "number" }, > "facility": { "type": "number" }, > "httpversion": { "type": "number" }, > "pid": { "type": "number" }, > "priority": { "type": "number" }, > "response": { "type": "number" }, > "windows\_response": { "type": "number" }, > "geoip": { > "dynamic": true, > "properties" : { > "ip": { "type": "ip" }, > "location": { "type": "geo\_point" } > } > } > } > } > } > } I tried a lot of things : create a new field and put lat and lon inside , convert all what i can into float type and check the type of all the fields,... but it doesn't work I think i will create a new topic because you answered my first question ( and i thank you ) and it's an other problem ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 24, 2020, 3:07pm UTC](https://discuss.elastic.co/t/how-to-check-if-the-field-exists-before-to-define-him-as-geoppoint/214871/8 "2020-02-24T15:07:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.