# Kibana showing geo-ip location as number not as geopoint **URL:** https://discuss.elastic.co/t/kibana-showing-geo-ip-location-as-number-not-as-geopoint/75600 **Category:** Kibana **Created:** [February 18, 2017, 2:16pm UTC](https://discuss.elastic.co/t/kibana-showing-geo-ip-location-as-number-not-as-geopoint/75600 "2017-02-18T14:16:31Z") **Posts on this page:** 4 **Page:** 1
### Author: ![varun1992](https://avatars.discourse-cdn.com/v4/letter/v/3da27b/32.png) [@varun1992](https://discuss.elastic.co/u/varun1992) #### Post date: [February 18, 2017, 2:16pm UTC](https://discuss.elastic.co/t/kibana-showing-geo-ip-location-as-number-not-as-geopoint/75600/1 "2017-02-18T14:16:31Z")
![](https://us1.discourse-cdn.com/elastic/original/2X/6/61c7735178db817e2119eaa893cc7cef56417605.png) my template is as below { "template" : "iisnew", "settings": { "index.refresh\_interval": "5s" }, "mappings" : { "iisnew" : { "properties": { "@timestamp":{"type":"date","format":"dateOptionalTime"}, "@version":{"type":"string", "index" : "not\_analyzed"}, "tags":{"type":"string"}, "type":{"type":"string"}, "geoip":{ "properties":{ "city\_name":{"type":"string", "index":"not\_analyzed"}, "continent\_code":{"type":"string"}, "country\_code2":{"type":"string"}, "country\_code3":{"type":"string"}, "country\_name":{"type":"string", "index":"not\_analyzed"}, "ip":{"type":"ip"}, "latitude":{"type":"double"}, "location":{"type":"geo\_point"}, "longitude":{"type":"double"}, "postal\_code":{"type":"string"}, "region\_code":{"type":"string", "index":"not\_analyzed"}, "region\_name":{"type":"string", "index":"not\_analyzed"}, "timezone":{"type":"string"} } }, "response":{"type":"long"}, "sc-status":{"type":"long"}, "sc-substatus":{"type":"long"}, "time-taken":{"type":"long"}, "c-ip":{"type":"ip"}, "cs":{"type":"string"}, "cs-method":{"type":"string"}, "cs-uri-query":{"type":"string"}, "cs-uri-stem":{"type":"string"}, "cs-username":{"type":"string"}, "host":{"type":"string"}, "message":{"type":"string"}, "path":{"type":"string"}, "s-port":{"type":"long"}, "s-sitename":{"type":"ip"}, } } } } my config file as below input { file { type =\> "iis-w3c" path =\> "C:/ElasticProducts/iis.log" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" } } filter { if [message] =~ "^#" { drop {} } grok { match =\> [ "message", "%{TIMESTAMP\_ISO8601:timestamp} %{IPORHOST:s-sitename} %{WORD:cs-method} %{URIPATH:cs-uri-stem} %{NOTSPACE:cs-uri-query} %{NUMBER:s-port} %{NOTSPACE:cs-username} %{IPORHOST:c-ip} %{NOTSPACE:cs(User-Agent)} %{NOTSPACE:cs(Referer)} %{NUMBER:response:int} %{NUMBER:sc-status:int} %{NUMBER:sc-substatus:int} %{NUMBER:time-taken:int}" ] } date { match =\> ["timestamp", "YYYY-MM-dd HH:mm:ss"] timezone =\> "Etc/UTC" } if [sc-bytes] { ruby { code =\> "event['kilobytesSent'] = event['sc-bytes'].to\_i / 1024.0" } } if [cs-bytes] { ruby { code =\> "event['kilobytesReceived'] = event['cs-bytes'].to\_i / 1024.0" } } mutate { ``` convert => ["sc-bytes", "integer"] convert => ["cs-bytes", "integer"] convert => ["time-taken", "integer"] remove_field => ["timestamp"] ``` } geoip { source =\> "c-ip" target =\> "geoip" add\_tag =\> ["iis-geoip"] ``` database => "C:/ElasticProducts/geoip/GeoLite2-City.mmdb" add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ] add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ] } ``` mutate { convert =\> ["[geoip][coordinates]", "float"] } useragent { source =\> "cs(User-Agent)" prefix=\> "browser" } } output { elasticsearch { hosts =\> ["localhost:9200"] user =\> "elastic" password =\> "changeme" ``` index => "iisnew" template => "C:\ElasticProducts\iisnew.json" document_type => "iis-log" ``` } stdout { codec =\> rubydebug } } ---
### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm) #### Post date: [February 19, 2017, 7:13am UTC](https://discuss.elastic.co/t/kibana-showing-geo-ip-location-as-number-not-as-geopoint/75600/2 "2017-02-19T07:13:26Z")
Your template name does not match your index name. See [https://www.elastic.co/guide/en/elasticsearch/reference/5.2/indices-templates.html#indices-templates](https://www.elastic.co/guide/en/elasticsearch/reference/5.2/indices-templates.html#indices-templates) ---
### Author: ![varun1992](https://avatars.discourse-cdn.com/v4/letter/v/3da27b/32.png) [@varun1992](https://discuss.elastic.co/u/varun1992) #### Post date: [February 19, 2017, 8:14am UTC](https://discuss.elastic.co/t/kibana-showing-geo-ip-location-as-number-not-as-geopoint/75600/3 "2017-02-19T08:14:16Z")
OK thanks for the help. Now i got some parse error in elastic search. command window. i checked grok with grok debugger. it didn't give any error. My editted config file and template as above. i changed iis to iisnew elastic search 5.2.0, logstash 5.2.0 [2017-02-19T02:30:14,239][DEBUG][o.e.a.b.TransportShardBulkAction] [LF\_KWPf] [iisnew][1] failed to execute bulk item (index) index {[iisnew][iis-log][AVpVfhZw\_\_C-MsaeEM-1], source[{"cs-method":"GET","s-sitename":"11.0.0.6","geoip":{"timezone":"Asia/Kolkata","ip":"103.15.254.29","latitude":10.5167,"coordinates":[76.2167,10.5167],"continent\_code":"AS","city\_name":"Thrissur","country\_code2":"IN","country\_name":"India","country\_code3":"IN","region\_name":"Kerala","location":[76.2167,10.5167],"postal\_code":"682301","longitude":76.2167,"region\_code":"KL"},"cs-uri-stem":"/portal/js/vendor/jquery.cookie.min.js","cs-uri-query":"-","sc-substatus":0,"message":"2017-02-16 14:56:51 11.0.0.6 GET /portal/js/vendor/jquery.cookie.min.js - 444 - 103.15.254.29 Mozilla/5.0+(Windows+NT+11.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/56.0.2924.87+Safari/537.36 [https://ace.centralus.cloudapp.azure.com:444/](https://ace.centralus.cloudapp.azure.com:444/) 200 0 0 265\r","type":"iis-w3c","cs-username":"-","time-taken":265,"tags":["iis-geoip"],"cs":["Mozilla/5.0+(Windows+NT+11.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/56.0.2924.87+Safari/537.36","[https://ace.centralus.cloudapp.azure.com:444/"],"path":"C:/ElasticProducts/iis.log","@timestamp":"2017-02-16T14:56:51.000Z","response":200,"s-port":"444","sc-status":0,"@version":"1","host":"ace-2","c-ip":"103.15.254.29](https://ace.centralus.cloudapp.azure.com:444/%22%5D,%22path%22:%22C:/ElasticProducts/iis.log%22,%22@timestamp%22:%222017-02-16T14:56:51.000Z%22,%22response%22:200,%22s-port%22:%22444%22,%22sc-status%22:0,%22@version%22:%221%22,%22host%22:%22ace-2%22,%22c-ip%22:%22103.15.254.29)"}]} org.elasticsearch.index.mapper.MapperParsingException: failed to parse at org.elasticsearch.index.mapper.DocumentParser.wrapInMapperParsingException(DocumentParser.java:175) ~[elasticsearch-5.2.0.jar:5.2.0] ![](https://us1.discourse-cdn.com/elastic/original/2X/a/adb8b099efe02fcae008e790062e19ded8569713.png) ---
### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system) #### Post date: [March 19, 2017, 8:14am UTC](https://discuss.elastic.co/t/kibana-showing-geo-ip-location-as-number-not-as-geopoint/75600/4 "2017-03-19T08:14:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.