How to create a geo_point field in logstash for a default index logstash-*

[George_Cherian]

Hi

How to make a field geo_point type in logstash itself , so that I don't need to initial create a index manually with geo_point temple and the use it in logstash , which is double work.

Thanks
George

[warkolm (Mark Walkom)]

You should leverage templates for your mappings, that is the best way if you are using a non logstash- named index.

[George_Cherian]

@warkolm

your mappings, that is the best way if you are using a non logstash

how can it be done for logstash-named index?

[warkolm (Mark Walkom)]

Are you changing the name of the field, or using the defaults from the geoip filter?

[George_Cherian]

@warkolm

geoip

I need the location field shown in the below snippet as geo_point , so for that can I use geoip plugin instead of mutate?

filter{
if[Site] == "Manassas"
{
mutate{
add_field => { "location" => "38.7509,-77.4753" }
}
}
........

[warkolm (Mark Walkom)]

Ohh ok, now that makes sense. (Side note, posting your config can help get a resolution a bit quicker )

You may need to adapt the existing template, because the default one by Logstash uses geoip.location but you are using just location. Otherwise, just call that field geoip.location.