Kibana4: geopoint visualization does not work


I am a Kibana newbie and i try to visualize my webserver-logs with geoip Information. I have a filter, which is creating the geoip Information, so I have a field geoip.location of type geo_point. But in the discovery page, this field is displayed as "Unindexed fields can not be searched"

geoip.location           ["9","51"]  

If I try to create a Tile map visualization, I can not select a field to create a map.

I found many threads with similar Problems but until now, I found no really working solution.

Thanks for your Support,

What's the mapping for the field set to in ES?

Hello Mark:

Here is the Mapping

geoip.location    geo_point  false true 

The Main Problem seems to be, that the mapping Shows the field as indexed and the discovery page says not indexed.

Best Regards,

Hello Mark,

maybe you requested this:

curl localhost:9200/logstash-2015.09.22/_all/_mapping?pretty

      "geoip" : {
    "dynamic" : "true",
    "properties" : {
      "location" : {
        "type" : "geo_point"

Best Regards,

Very odd, that mapping is correct.

Are you having the same issue on newer indices?

Hi Mark,

yes, if I re-create the indices, I get the same results. I also tried to create complete new indices (as you described in another similar thread). The result was, that the geoip.location field hat the type "number" instead of "geo_point".

Can you gist/pastebin/etc your mappings and some sample data, enough for someone to replicate the issue, and I'll give it a go.

Hello Mark,

Mappings: see

Sample Data: - [28/Sep/2015:00:00:00 +0200] "GET /media/03_design/img/intern/customer_logo_0x35.png HTTP/1.1" 200 2318 "" "Mozilla/5.0 (Linux; U; Android 4.1.2; de-de; SAMSUNG GT-I8190N/I8190NXXANR6 Build/JZO54K) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30" - 0 -

The Apache Access logs are tagged as type "apache-access" using the logstash-forwarder.

Best Regards

What about the LS config?
And which mapping is it using?


I am loading the information from my webserver to elasticsearch using packetbeats and when I am trying your dashboards on the geopoint visualization I am getting an error saying the following: Visualize: Expected geo_point type on field [client_location], but got [string]
When I am going to the settings to change the format of the client_location I have only two options to string, or default which is string. Is there any way to disable the string into false?

Please start your own thread for this.