Kibana4: geopoint visualization does not work

Elastic Stack Kibana
1

Hello,

I am a Kibana newbie and i try to visualize my webserver-logs with geoip Information. I have a filter, which is creating the geoip Information, so I have a field geoip.location of type geo_point. But in the discovery page, this field is displayed as "Unindexed fields can not be searched"

geoip.location           ["9","51"]

If I try to create a Tile map visualization, I can not select a field to create a map.

I found many threads with similar Problems but until now, I found no really working solution.

Thanks for your Support,
Florian

2

What's the mapping for the field set to in ES?

3

Hello Mark:

Here is the Mapping

geoip.location    geo_point  false true

The Main Problem seems to be, that the mapping Shows the field as indexed and the discovery page says not indexed.

Best Regards,
Florian

4

Hello Mark,

maybe you requested this:

curl localhost:9200/logstash-2015.09.22/_all/_mapping?pretty

      "geoip" : {
    "dynamic" : "true",
    "properties" : {
      "location" : {
        "type" : "geo_point"
      }
    }
  },

Best Regards,
Florian

5

Very odd, that mapping is correct.

Are you having the same issue on newer indices?

6

Hi Mark,

yes, if I re-create the indices, I get the same results. I also tried to create complete new indices (as you described in another similar thread). The result was, that the geoip.location field hat the type "number" instead of "geo_point".

7

Can you gist/pastebin/etc your mappings and some sample data, enough for someone to replicate the issue, and I'll give it a go.

8

Hello Mark,

Mappings: see http://pastebin.ca/3176982

Sample Data:

111.222.33.44 www.customer.de - [28/Sep/2015:00:00:00 +0200] "GET /media/03_design/img/intern/customer_logo_0x35.png HTTP/1.1" 200 2318 "http://www.customer.de/digitale_handzettel.jsp" "Mozilla/5.0 (Linux; U; Android 4.1.2; de-de; SAMSUNG GT-I8190N/I8190NXXANR6 Build/JZO54K) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30" - 0 -

The Apache Access logs are tagged as type "apache-access" using the logstash-forwarder.

Best Regards
Florian

9

What about the LS config?
And which mapping is it using?

10

Hello,

I am loading the information from my webserver to elasticsearch using packetbeats and when I am trying your dashboards on the geopoint visualization I am getting an error saying the following: Visualize: Expected geo_point type on field [client_location], but got [string]
When I am going to the settings to change the format of the client_location I have only two options to string, or default which is string. Is there any way to disable the string into false?

11

Please start your own thread for this.