Location type geo_point

[Elves_Ribeiro]

Hi,

I am trying to create a map on my environment, but I am not able to create the field location type geo_point. I am using version 7.10.2

My logstash conf

 geoip {

  source => "ip_client"

}

mutate {

add_field => [ "[geoip][location]" , "%{longitude}" ]

add_field => [ "[geoip][location]" , "%{latitude}" ]

}

My template

{

  "index_templates" : [

    {

      "name" : "big_ip",

      "index_template" : {

        "index_patterns" : [

          "big_ip-waf-logs-*"

        ],

        "template" : {

          "settings" : {

            "index" : {

              "number_of_shards" : "1"

            }

          },

          "mappings" : {

            "properties" : {

              "location" : {

                "type" : "geo_point"

              }

            }

          },

          "aliases" : {

            "mydata" : { }

          }

        },

        "composed_of" : [ ],

        "priority" : 200,

        "version" : 3,

        "_meta" : {

          "description" : "Big IP WAF"

        }

      }

    }

  ]

}

##The error:

[2021-01-25T06:11:02,319][WARN ][logstash.outputs.elasticsearch][main][ebd65197aef2322dde6d849c25af897d96eba0752661fccf151896a01975c723] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"big_ip-waf-logs-2021.01.25", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0x3df7f5a7>], :response=>{"index"=>{"_index"=>"big_ip-waf-logs-2021.01.25", "_type"=>"_doc", "_id"=>"zUAqOHcBdgZ1N8nvwsIf", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [geoip.location] cannot be changed from type [float] to [text]"}}}}

{

[warkolm (Mark Walkom)]

Welcome to our community!

@Elves_Ribeiro

mutate {

add_field => [ "[geoip][location]" , "%{longitude}" ]

add_field => [ "[geoip][location]" , "%{latitude}" ]

}

You shouldn't need to do this if the geoip filter is working properly.

@Elves_Ribeiro

mapper [geoip.location] cannot be changed from type [float] to [text]

Though that would suggest that the filter is not working for some reason.

Can you post one of the events that is in Elasticsearch that Logstash has processed?

[Elves_Ribeiro]

Hi,

I solved the problem by changing my template:

PUT _index_template/test
{
  "index_patterns": ["test**"],
  "template": {
    "settings": {
      "number_of_shards": 1
    },
  "mappings": {
  "properties": {
     "geoip": {
        "dynamic": true,
    "properties": {
      "ip": {
            "type": "ip"
          },
          "latitude": {
            "type": "half_float"
          },
          "location": {
            "type": "geo_point"
          },
          "longitude": {
            "type": "half_float"
          }
        }
      }
  },
    "aliases": {
      "mydata": { }
    }
  },
  "priority": 200,
  "version": 3,
  "_meta": {
    "description": "Test"
  }

My logstash file:

 geoip {

  source => "ip_client"

}