# Index template for multi-level field

**URL:** https://discuss.elastic.co/t/index-template-for-multi-level-field/40171
**Category:** Beats
**Tags:** filebeat
**Created:** [January 26, 2016, 10:29pm UTC](https://discuss.elastic.co/t/index-template-for-multi-level-field/40171 "2016-01-26T22:29:57Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Florin\_Andrei](https://avatars.discourse-cdn.com/v4/letter/f/c77e96/32.png) [@Florin\_Andrei](https://discuss.elastic.co/u/Florin_Andrei)
#### Post date: [January 26, 2016, 10:29pm UTC](https://discuss.elastic.co/t/index-template-for-multi-level-field/40171/1 "2016-01-26T22:29:58Z")

</div>

A while ago, I made a Logstash filter that extracts geolocation information from the client IP in Nginx logs, like this:

geoip {  
source =\> "clientip"  
target =\> "geoip"  
database =\> "/etc/logstash/GeoLiteCity.dat"  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ]  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ]  
}

Then I had to modify the Filebeat index template that was loaded into ElasticSearch, in order to mark the geoip.location field with the type geo\_point. The index template I've used is this:

```
{
  "mappings": {
    "_default_": {
      "_all": {
        "enabled": true,
        "norms": {
          "enabled": false
        }
      },
      "dynamic_templates": [
        {
          "template1": {
            "mapping": {
              "doc_values": true,
              "ignore_above": 1024,
              "index": "not_analyzed",
              "type": "{dynamic_type}"
            },
            "match": "*"
          }
        }
      ],
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "message": {
          "type": "string",
          "index": "analyzed"
        },
        "offset": {
          "type": "long",
          "doc_values": "true"
        },
        "geoip" : {
          "type" : "object",
          "dynamic": true,
          "properties" : {
            "location" : { "type" : "geo_point" }
          }
        }
      }
    }
  },
  "settings": {
    "index.refresh_interval": "5s"
  },
  "template": "filebeat-*"
}

```

More recently I've used the json plugin in logstash to extract a JSON document into a field, from a different log source, like this:

json {  
source =\> "data"  
target =\> "node\_post\_data\_json"  
}

This has created the field node\_post\_data\_json.geocode.coordinates, which I would like to mark as type geo\_point. But the problem is, the geo\_point field is three levels down, instead of two, and I'm not sure what is the correct syntax in the template for that. I've tried the template shown below, but it doesn't seem to do anything. What is the correct syntax?

```
{
  "mappings": {
    "_default_": {
      "_all": {
        "enabled": true,
        "norms": {
          "enabled": false
        }
      },
      "dynamic_templates": [
        {
          "template1": {
            "mapping": {
              "doc_values": true,
              "ignore_above": 1024,
              "index": "not_analyzed",
              "type": "{dynamic_type}"
            },
            "match": "*"
          }
        }
      ],
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "message": {
          "type": "string",
          "index": "analyzed"
        },
        "offset": {
          "type": "long",
          "doc_values": "true"
        },
        "geoip" : {
          "type" : "object",
          "dynamic": true,
          "properties" : {
            "location" : { "type" : "geo_point" }
          }
        },
        "node_post_data_json": {
          "type" : "object",
          "dynamic": true,
          "properties" : {
            "geocode": {
              "type" : "object",
              "dynamic": true,
              "properties" : {
                "coordinates" : { "type" : "geo_point" }
              }
            }
          }
        }
      }
    }
  },
  "settings": {
    "index.refresh_interval": "5s"
  },
  "template": "filebeat-*"
}
```

---

<div class="post-metadata">

### Author: ![Florin\_Andrei](https://avatars.discourse-cdn.com/v4/letter/f/c77e96/32.png) [@Florin\_Andrei](https://discuss.elastic.co/u/Florin_Andrei)
#### Post date: [January 27, 2016, 12:25am UTC](https://discuss.elastic.co/t/index-template-for-multi-level-field/40171/2 "2016-01-27T00:25:32Z")

</div>

Replying to my own question:

Actually, that's the correct syntax. I just had to wait until the next daily index was created, and the field was automagically created with the intended type.

---

<div class="post-metadata">

### Author: ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [January 27, 2016, 9:40am UTC](https://discuss.elastic.co/t/index-template-for-multi-level-field/40171/3 "2016-01-27T09:40:49Z")

</div>

The issue is that mapping of existing indices with data can't be updated, but as one index is created per in your case, every day a new mapping can be used. Thanks for providing all the details and also the answer for others.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 9:56pm UTC](https://discuss.elastic.co/t/index-template-for-multi-level-field/40171/4 "2017-07-05T21:56:20Z")

</div>