# Index template not being applied

**URL:** https://discuss.elastic.co/t/index-template-not-being-applied/204277
**Category:** Elasticsearch
**Created:** [October 18, 2019, 8:34pm UTC](https://discuss.elastic.co/t/index-template-not-being-applied/204277 "2019-10-18T20:34:02Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![John\_Doe3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/john_doe3/32/45110_2.png) [@John\_Doe3](https://discuss.elastic.co/u/John_Doe3)
#### Post date: [October 18, 2019, 8:34pm UTC](https://discuss.elastic.co/t/index-template-not-being-applied/204277/1 "2019-10-18T20:34:02Z")

</div>

To achieve my goal - map geo location data from nginx logs to a map - I added a index template to ES with command like this:

```
PUT _template/nginx-default
{
"template": "nginx-*",
"order": 0,
"index_patterns" : [
  "nginx*"
],
"settings": {
"index.mapping.ignore_malformed": true
},
  "mappings" : {
      "properties" : {
        "@timestamp" : {
          "type" : "date"
        },

```

...  
"geoip" : {  
"location" : {  
"type": "geo\_point"  
},  
},

...  
}  
}

After creating this template, I issued a complete reload of all data (removed indices from ES and deleted registry file in filebeat - I dont have that much data).

The location field contains two properties, lat and lon, submitted as numbers:

```
geoip.location.lat: number
geoip.location.lon: number

```

Example:

```
|#geoip.location.lat|37.751|
|---|---|
|#geoip.location.lon|-97.822|

```

But when I try to create a map, I still get the feedback, that there is no geo\_ip field:

> The index pattern nginx\* does not contain any of the following compatible field types: geo\_point

What am I missing here?

Thanks!

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [October 18, 2019, 8:43pm UTC](https://discuss.elastic.co/t/index-template-not-being-applied/204277/2 "2019-10-18T20:43:56Z")

</div>

Can you show the name and full mapping of one of the indices? Can you show a sample indexed document?

---

<div class="post-metadata">

### Author: ![John\_Doe3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/john_doe3/32/45110_2.png) [@John\_Doe3](https://discuss.elastic.co/u/John_Doe3)
#### Post date: [October 19, 2019, 2:42pm UTC](https://discuss.elastic.co/t/index-template-not-being-applied/204277/3 "2019-10-19T14:42:08Z")

</div>

Sure.. the name of one index is "nginx-2019-04".

find the data here:

[https://pastebin.com/fmVb4f59](https://pastebin.com/fmVb4f59)

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [October 19, 2019, 5:38pm UTC](https://discuss.elastic.co/t/index-template-not-being-applied/204277/4 "2019-10-19T17:38:24Z")

</div>

When you look at an indexed document is the location geo\_point field filled in

How are you ingesting the data?

---

<div class="post-metadata">

### Author: ![John\_Doe3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/john_doe3/32/45110_2.png) [@John\_Doe3](https://discuss.elastic.co/u/John_Doe3)
#### Post date: [October 20, 2019, 8:54am UTC](https://discuss.elastic.co/t/index-template-not-being-applied/204277/5 "2019-10-20T08:54:53Z")

</div>

Hey

yes, it is (you can see it on pastebin,let me post relevant part here again:

```
"geoip": {

          "ip": "123.456.789.0",

          "country_code2": "DE",

          "location": {

            "lon": 13.123,

            "lat": 52.123

          },

          "region_code": "BE",

          "continent_code": "EU",

          "timezone": "Europe/Berlin",

          "city_name": "Berlin",

          "country_code3": "DE",

          "latitude": 52.123,

          "postal_code": "12345",

          "country_name": "Germany",

          "region_name": "Land Berlin",

          "longitude": 13.456

        },

```

The index on Kibana, though, does not show the location-field itself, but it's properties (lon / lat):

![grafik](https://us1.discourse-cdn.com/elastic/original/3X/7/b/7be0ce3d5c9aa52a41f3c92976aeb1fa7872d1dc.png)

Data comes from Filebeat, via Logstash, where I configured filering. This is the GeoIp-Part:

```
  geoip {
    source => "[nginx][access][client]"
  }
```

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [October 20, 2019, 9:20am UTC](https://discuss.elastic.co/t/index-template-not-being-applied/204277/6 "2019-10-20T09:20:48Z")

</div>

Was the index created after you added the index template? The template only applies when the index is first created as you can not change mappings in existing indices.

---

<div class="post-metadata">

### Author: ![John\_Doe3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/john_doe3/32/45110_2.png) [@John\_Doe3](https://discuss.elastic.co/u/John_Doe3)
#### Post date: [October 20, 2019, 12:13pm UTC](https://discuss.elastic.co/t/index-template-not-being-applied/204277/7 "2019-10-20T12:13:49Z")

</div>

That's what I was missing. I only deleted the Index in Elasticsearch. So, this template applies to the data when creating the Kibana Index, not the Elastic Search Index.

Thanks a lot!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 17, 2019, 12:13pm UTC](https://discuss.elastic.co/t/index-template-not-being-applied/204277/8 "2019-11-17T12:13:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
