Kibana4: geo_point

Elastic Stack Kibana
1

Hi,

I am trying to use geoip, it does the indexing properly but when i see in Kibana4 i get the following error:
No Compatible Fields: The "xxxx" index pattern does not contain any of the following field types: geo_point

I have tried various things which are commented below, but not able to load the latitude & longitude
geoip {
source => "c-ip"
target => "geoip"
#add_tag => [ "iis-geoip" ]
#add_field => [ "[location][lat]", "%{[geoip][longitude]}" ]
#add_field => [ "[location][lon]", "%{[geoip][latitude]}" ]
}

Please let me know how this can be resolved.

Thanks
Joydeep

2

first, your geoip configuration should include a path to geoip database ... something like this:

geoip {
    source => "c-ip"
    target => "geoip"
    database => "/etc/logstash/GeoLiteCity.dat"
    add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
    add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
  }
  mutate {
    convert => [ "[geoip][coordinates]", "float"]
  }
}

also its possible that fields dont have the right mappings ... you can check this with:

curl host:9200/INDEXNAME/_mapping

please let me know if this helps. if it doesnt can you provide your full config file and the output of above command (mappings)

regards, Peter

3

You don't need this unless you have changed the default path.

But your mappings commends are spot on, it'd be good to check them.