Kibana MAP stopt working without making chances expect new input

Elastic Stack Logstash
1

For some reason my geo.ip.location stopt working. I tryed to reindex my data but the field is gone.
I have not made any changes in the last days.

Starting logstash output:

[2017-11-27T13:47:01,091][INFO ][logstash.outputs.elasticsearch] Using mapping template from {:path=>nil}
[2017-11-27T13:47:01,120][INFO ][logstash.outputs.elasticsearch] Attempting to install template {:manage_template=>{"template"=>"logstash-", "version"=>50001, "settings"=>{"index.refresh_interval"=>"5s"}, "mappings"=>{"default"=>{"_all"=>{"enabled"=>true, "norms"=>false}, "dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date", "include_in_all"=>false}, "@version"=>{"type"=>"keyword", "include_in_all"=>false}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}}

Mapping output:

get /_template/gmailheaderscsv
{
"gmailheaderscsv": {
"order": 0,
"template": "csv*",
"settings": {},
"mappings": {
"default": {
"dynamic_templates": [
{
"location_fields": {
"mapping": {
"type": "geo_point"
},
"match": "location"
}
}
]
}
},
"aliases": {}
}
}

My IP information is stil working and I stil have to following fields:

geoip.city_name
geoip.continent_code
geoip.country_code2
geoip.country_code3
geoip.country_name
geoip.dma_code
geoip.ip
geoip.latitude
geoip.location.lat
geoip.location.lon
geoip.longitude
geoip.postal_code
geoip.region_code
geoip.region_name
geoip.timezone

When trying to create a new map visualization I get the following error message:

No Compatible Fields: The "gmailheaderscsv" index pattern does not contain any of the following field types: geo_point

I am lost and not sure where to look or troubleshoot. Could someone help me and give me some
tips or directions where I could/should look?
My map stopt displaying IP locations so I deleted the index with delete gmailheaderscsv and now it cant find geo_point anymore.

2

Is the definition for /_template/gmailheaderscsv correct? It looks like it has problem to find the geo_point location from GeoIP.

3

I'm not sure, it looks fine to me. Atleast it did work with this template before ahaha.
Thanks for your response.
{
"gmailheaderscsv": {
"order": 0,
"template": "csv*",
"settings": {},
"mappings": {
"default": {
"dynamic_templates": [
{
"location_fields": {
"mapping": {
"type": "geo_point"
},
"match": "location"
}
}
]
}
},
"aliases": {}
}
}

4

If the definition is correct, then I could not see any other issues from the error message.

I found out that there is another IP2Location filter that could provides geolocation information by IP address using Logstash.

You can consider this alternative if the issue persists. I hope I could be more helpful.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.