# How to use geoip logstash filter? **URL:** \ **Category:** Logstash\ **Created:** [July 18, 2017, 7:12am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513 "2017-07-18T07:12:25Z")\ **Posts on this page:** 18\ **Page:** 2
**Author:** ![DharaniKumar](https://avatars.discourse-cdn.com/v4/letter/d/97f17d/32.png) [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)\ **Post date:** [August 7, 2017, 6:09am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/21 "2017-08-07T06:09:55Z")
Just now i tried GET /\_all/\_mapping?pretty command and it seems that filebeat is not mapped correctly. Other beats like heartbeat, metricbeat, packetbeat is mapped well. Where im stuck is what index name do i need to use? Whether it is filebeat-\* or just filebeat because im having the following filebeat indices like: filebeat-2017.08.04, filebeat-2017.08.03, filebeat-2017.08.02, ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 7, 2017, 6:34am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/22 "2017-08-07T06:34:54Z")
> Where im stuck is what index name do i need to use? You don't _need_ to use any name. What do you _want_ to name your indexes? Pick something that works for you and adjust templates and other configuration to match. ---
**Author:** ![DharaniKumar](https://avatars.discourse-cdn.com/v4/letter/d/97f17d/32.png) [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)\ **Post date:** [August 7, 2017, 8:54am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/24 "2017-08-07T08:54:17Z")
Now in filebeat template location field is set to geo\_point value @magnusbaeck. "location":{"latitude":"12.9719258","longitude":"80.2171973"} this is my location field value in my log file. After started file beat witht this location value in my log the latitude field is like "location.latitude" and for longitude like "location.langitude". I mapped location as geoip.location and that is fine and mapped as geo\_point. But these two fields are set to string values. ---
**Author:** ![DharaniKumar](https://avatars.discourse-cdn.com/v4/letter/d/97f17d/32.png) [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)\ **Post date:** [August 7, 2017, 8:54am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/25 "2017-08-07T08:54:59Z")
Do i need to change anything in latitude and longitude fields or those fields are fine? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 7, 2017, 9:30am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/26 "2017-08-07T09:30:50Z")
Show the mapping of the `location` field so we can see that it really is geo\_point. Secondly, [https://www.elastic.co/guide/en/elasticsearch/reference/current/geo-point.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/geo-point.html) documents the four ways a field can look like for ES to properly handle it as geo\_point. Your `location` value doesn't match any of those formats. ---
**Author:** ![DharaniKumar](https://avatars.discourse-cdn.com/v4/letter/d/97f17d/32.png) [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)\ **Post date:** [August 7, 2017, 9:38am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/27 "2017-08-07T09:38:41Z")
Following is how i mapped geo\_point to location: { "filebeat": { "order": 0, "template": "filebeat-\*", "settings": { "index": { "number\_of\_shards": "1" } }, "mappings": { "beat": { "properties": { "geoip.location": { "type": "geo\_point" } } } }, "aliases": {} } } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 7, 2017, 9:54am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/28 "2017-08-07T09:54:24Z")
I didn't ask for the template, I asked for the actual mappings. If I want to see the template I'll ask for the template. But since you posted your template I might as well comment on it. A couple of days ago I said this: - If geoip.location is the field you’ve mapped as geo\_point it’s not surprising that the location field isn’t recognized as geo\_point. If you want location to be a geo\_point you need to make sure that field is mapped as geo\_point. - That’s not how the mapping of a nested field is set. Consult the ES documentation for details. These two comments still apply to your current template. ---
**Author:** ![DharaniKumar](https://avatars.discourse-cdn.com/v4/letter/d/97f17d/32.png) [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)\ **Post date:** [August 7, 2017, 9:58am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/29 "2017-08-07T09:58:24Z")
what ES documentation @magnusbaeck? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 7, 2017, 10:00am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/30 "2017-08-07T10:00:35Z")
See the example at [https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-put-mapping.html#updating-field-mappings](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-put-mapping.html#updating-field-mappings). ---
**Author:** ![DharaniKumar](https://avatars.discourse-cdn.com/v4/letter/d/97f17d/32.png) [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)\ **Post date:** [August 7, 2017, 10:00am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/31 "2017-08-07T10:00:54Z")
"beat": { "properties": { "geoip": { "properties": { "location": { "type": "geo\_point" This is my mapping ---
**Author:** ![DharaniKumar](https://avatars.discourse-cdn.com/v4/letter/d/97f17d/32.png) [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)\ **Post date:** [August 7, 2017, 10:02am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/32 "2017-08-07T10:02:29Z")
This is how i put mapping: PUT \_template/filebeat?pretty { "template": "filebeat-\*", "settings": { "number\_of\_shards": 1 }, "mappings": { "beat": { "properties": { "geoip.location": { "type": "geo\_point" } } } } } ---
**Author:** ![DharaniKumar](https://avatars.discourse-cdn.com/v4/letter/d/97f17d/32.png) [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)\ **Post date:** [August 7, 2017, 10:10am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/33 "2017-08-07T10:10:54Z")
is that right or i just set it as location instead of geoip.location? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 7, 2017, 10:18am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/34 "2017-08-07T10:18:42Z")
> This is how i put mapping: > > PUT \_template/filebeat?pretty That sets the _template_ which may or may not apply to your indexes. That template is still wrong because your field in your documents is named `location`. ---
**Author:** ![DharaniKumar](https://avatars.discourse-cdn.com/v4/letter/d/97f17d/32.png) [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)\ **Post date:** [August 7, 2017, 10:23am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/35 "2017-08-07T10:23:47Z")
But i deleted all my filebeat indexes. After clearing all that i made that mapping and what i put in mapping field is set to filebeat template... ---
**Author:** ![DharaniKumar](https://avatars.discourse-cdn.com/v4/letter/d/97f17d/32.png) [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)\ **Post date:** [August 7, 2017, 10:37am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/36 "2017-08-07T10:37:27Z")
Also when i refreshed my index pattern in kibana geoip.location field is set to "geo\_point" ---
**Author:** ![DharaniKumar](https://avatars.discourse-cdn.com/v4/letter/d/97f17d/32.png) [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)\ **Post date:** [August 7, 2017, 10:38am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/37 "2017-08-07T10:38:31Z")
geoip.location geo\_point location.latitude number location.longitude number This is how its showing in kibana ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 7, 2017, 11:23am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/38 "2017-08-07T11:23:02Z")
Have you tried fixing your template so it maps `location` as geo\_point so the mappings match your data? Over and out. I can't spend any more time on this matter. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 4, 2017, 11:23am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/39 "2017-09-04T11:23:05Z")
Closed on September 4, 2017, 11:23am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. [Previous page](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513.md?page=1)