My filebeat config:
setup.template.name: "jkb-api"
setup.template.pattern: "jkb-api-*"
setup.template.fields: "/etc/filebeat/fields.yml" /// The default fields.yml
setup.template.overwrite: true
Kibana's 'Dev-Tools':
"apache2": {
"properties": {
"access": {
"properties": {
"user_name": {
"type": "keyword",
"ignore_above": 1024
},
"user_agent": {
"properties": {
"major": {
"type": "long"
},
"name": {
"type": "keyword",
"ignore_above": 1024
},
"os": {
"type": "keyword",
"ignore_above": 1024
},
"os_major": {
"type": "long"
},
"os_minor": {
"type": "long"
},
"os_name": {
"ignore_above": 1024,
"type": "keyword"
},
"device": {
"type": "keyword",
"ignore_above": 1024
},
"minor": {
"type": "long"
},
"patch": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"remote_ip": {
"type": "keyword",
"ignore_above": 1024
},
"url": {
"type": "keyword",
"ignore_above": 1024
},
"http_version": {
"type": "keyword",
"ignore_above": 1024
},
"response_code": {
"type": "long"
},
"body_sent": {
"properties": {
"bytes": {
"type": "long"
}
}
},
"referrer": {
"type": "keyword",
"ignore_above": 1024
},
"agent": {
"type": "text",
"norms": false
},
"geoip": {
"properties": {
"country_iso_code": {
"type": "keyword",
"ignore_above": 1024
},
"location": {
"type": "geo_point" /// there is it
},
"region_name": {
"type": "keyword",
"ignore_above": 1024
},
"city_name": {
"ignore_above": 1024,
"type": "keyword"
},
"continent_name": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"method": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"error": {
"properties": {
"module": {
"type": "keyword",
"ignore_above": 1024
},
"level": {
"type": "keyword",
"ignore_above": 1024
},
"client": {
"type": "keyword",
"ignore_above": 1024
},
"message": {
"type": "text",
"norms": false
},
"pid": {
"type": "long"
},
"tid": {
"type": "long"
}
}
}
}
},
I'm so confused about getting an error when I create "coordinate Map":
No Compatible Fields: The "jkb-api-*" index pattern does not contain any of the following field types: geo_point
PS: I'm using filebeat apache2 module,and all fields are default