Ingest geoip processor dynamic mappings not as expected

Elastic Stack Elasticsearch
1

I've configured the ingest geoip processor but when it creates its various fields, e.g. lat and lon, they are floats. there is no field of type 'geoip' created with the dynamic mapping. this is unexpected as i figured a processor that does geocoding would of course create data of type geoip that is suitable for using with maps in kibana.

So I guess that's not the case, that I have to explicitly create a mapping first. But I don't know precisely what mapping to create and cannot find this in the docs.

Thanks

2

indeed, you are not mistaken. A change in the mapping is necessary to recognize this
enriched location field as a geo_point for geo-queries to work.

I've opened a pull request to update the documentation, feel free to comment if you
think my amendment needs improvement!

thanks!

3

thank you. so then as i understand it, I need to manually specify the mapping, i cannot expect dynamic mapping to work.

since you evidently have a good understanding of the processor, could I ask you to concur that this would be an appropriate mapping?

Here's some data:

"geo_real_ip": {
  "continent_name": "North America",
  "city_name": "Bethesda",
  "country_iso_code": "US",
  "region_name": "Maryland",
  "location": {
    "lon": -77.9602,
    "lat": 39.1032
  }
}

Here's the part of the mapping I don't quite understand:

         "location": {
             "type": "geopoint",  // is this correct?
            "properties": {
              "lat": {
                "type": "float"
              },
              "lon": {
                "type": "float"
              }
            }
          },
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.