# Logstash Data not visible on coordinate map **URL:** \ **Category:** Logstash\ **Created:** [June 23, 2018, 6:33am UTC](https://discuss.elastic.co/t/logstash-data-not-visible-on-coordinate-map/137104 "2018-06-23T06:33:15Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![Venkatesan\_S\_Venkate](https://avatars.discourse-cdn.com/v4/letter/v/43a26b/32.png) [@Venkatesan\_S\_Venkate](https://discuss.elastic.co/u/Venkatesan_S_Venkate)\ **Post date:** [June 23, 2018, 6:33am UTC](https://discuss.elastic.co/t/logstash-data-not-visible-on-coordinate-map/137104/1 "2018-06-23T06:33:16Z")
I created the .conf file and executed through the log stash. It filters using the geo ip. It creates the data according to requirement. When I open Kibana and try to visualise in the coordinate map it is not visible even after choosing location in geopoint. I created the template on the console for the index eve then it is not visible. When I try to create an index through console and visualise the map then it shows in the map. I could not figure out the problem ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 23, 2018, 6:38am UTC](https://discuss.elastic.co/t/logstash-data-not-visible-on-coordinate-map/137104/2 "2018-06-23T06:38:12Z")
Can you share the mappings and structure of the indices you are talking about? ---
**Author:** ![Venkatesan\_S\_Venkate](https://avatars.discourse-cdn.com/v4/letter/v/43a26b/32.png) [@Venkatesan\_S\_Venkate](https://discuss.elastic.co/u/Venkatesan_S_Venkate)\ **Post date:** [June 23, 2018, 6:41am UTC](https://discuss.elastic.co/t/logstash-data-not-visible-on-coordinate-map/137104/3 "2018-06-23T06:41:16Z")
Template PUT /\_template/template\_name { "order": 0, "index\_patterns": "logstash\*", "settings": {}, "mappings": { "_default_": { "properties": { "location": { "type": "geo\_point" } } } } } conf file input { file { # type =\> "geo\_point" path =\> "/Users/iiita/elk/example/aa.csv" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" } # stdin {} } filter { ``` csv { separator => "," columns => ["HostIP"] } geoip{ source => "HostIP" } ``` } output { elasticsearch { hosts =\> ["[http://localhost:9200](http://localhost:9200)"] index =\> ["logstash-venkat"] } stdout{ codec =\> rubydebug } } ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 23, 2018, 6:43am UTC](https://discuss.elastic.co/t/logstash-data-not-visible-on-coordinate-map/137104/4 "2018-06-23T06:43:48Z")
The geoip plugin stores the location in `geoip.location` and not just `location` which what you have specified in your mapping. Get the mapping from the actual index (not the template) and check what the mapping for the relevant fields are. ---
**Author:** ![Venkatesan\_S\_Venkate](https://avatars.discourse-cdn.com/v4/letter/v/43a26b/32.png) [@Venkatesan\_S\_Venkate](https://discuss.elastic.co/u/Venkatesan_S_Venkate)\ **Post date:** [June 23, 2018, 6:50am UTC](https://discuss.elastic.co/t/logstash-data-not-visible-on-coordinate-map/137104/5 "2018-06-23T06:50:07Z")
can you tell me the way to write mapping the in actual index. when i write in the index mapping on the console it shows type already there ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 23, 2018, 6:55am UTC](https://discuss.elastic.co/t/logstash-data-not-visible-on-coordinate-map/137104/6 "2018-06-23T06:55:01Z")
What does the actual mapping look like? ---
**Author:** ![Venkatesan\_S\_Venkate](https://avatars.discourse-cdn.com/v4/letter/v/43a26b/32.png) [@Venkatesan\_S\_Venkate](https://discuss.elastic.co/u/Venkatesan_S_Venkate)\ **Post date:** [June 23, 2018, 6:56am UTC](https://discuss.elastic.co/t/logstash-data-not-visible-on-coordinate-map/137104/7 "2018-06-23T06:56:32Z")
PUT logstash-venkat/\_mapping/my\_type { "my\_type": { "properties": { "geoip.location": { "type": "geo\_point" } } } } ---
**Author:** ![Venkatesan\_S\_Venkate](https://avatars.discourse-cdn.com/v4/letter/v/43a26b/32.png) [@Venkatesan\_S\_Venkate](https://discuss.elastic.co/u/Venkatesan_S_Venkate)\ **Post date:** [June 23, 2018, 6:58am UTC](https://discuss.elastic.co/t/logstash-data-not-visible-on-coordinate-map/137104/8 "2018-06-23T06:58:57Z")
PUT logstash-venkat { "mappings": { "doc": { "properties": { "location": { "type": "geo\_point" } } } } } Message #! Deprecation: [_default_] mapping is deprecated since it is not useful anymore now that indexes cannot have more than one type { "acknowledged": true, "shards\_acknowledged": true, "index": "logstash-venkat" } ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 23, 2018, 6:59am UTC](https://discuss.elastic.co/t/logstash-data-not-visible-on-coordinate-map/137104/9 "2018-06-23T06:59:02Z")
Which version of Elasticsearch are you using? ---
**Author:** ![Venkatesan\_S\_Venkate](https://avatars.discourse-cdn.com/v4/letter/v/43a26b/32.png) [@Venkatesan\_S\_Venkate](https://discuss.elastic.co/u/Venkatesan_S_Venkate)\ **Post date:** [June 23, 2018, 6:59am UTC](https://discuss.elastic.co/t/logstash-data-not-visible-on-coordinate-map/137104/10 "2018-06-23T06:59:29Z")
6.3.0 ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 23, 2018, 7:11am UTC](https://discuss.elastic.co/t/logstash-data-not-visible-on-coordinate-map/137104/11 "2018-06-23T07:11:42Z")
That looks potentially incorrect. Set the mapping like this: ```auto PUT logstash-venkat/_mapping/my_type { "properties": { "geoip": { "properties": { "location": { "type": "geo_point" } } } } } ``` ---
**Author:** ![Venkatesan\_S\_Venkate](https://avatars.discourse-cdn.com/v4/letter/v/43a26b/32.png) [@Venkatesan\_S\_Venkate](https://discuss.elastic.co/u/Venkatesan_S_Venkate)\ **Post date:** [June 23, 2018, 7:22am UTC](https://discuss.elastic.co/t/logstash-data-not-visible-on-coordinate-map/137104/12 "2018-06-23T07:22:41Z")
Following error comes out { "error": { "root\_cause": [ { "type": "illegal\_argument\_exception", "reason": "Rejecting mapping update to [logstash-venkat] as the final mapping would have more than 1 type: [logs, my\_type]" } ], "type": "illegal\_argument\_exception", "reason": "Rejecting mapping update to [logstash-venkat] as the final mapping would have more than 1 type: [logs, my\_type]" }, "status": 400 } ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 23, 2018, 7:23am UTC](https://discuss.elastic.co/t/logstash-data-not-visible-on-coordinate-map/137104/13 "2018-06-23T07:23:27Z")
Yes, you can not change the mapping of an existing index, so will need to drop and recreate it. ---
**Author:** ![Venkatesan\_S\_Venkate](https://avatars.discourse-cdn.com/v4/letter/v/43a26b/32.png) [@Venkatesan\_S\_Venkate](https://discuss.elastic.co/u/Venkatesan_S_Venkate)\ **Post date:** [June 23, 2018, 7:31am UTC](https://discuss.elastic.co/t/logstash-data-not-visible-on-coordinate-map/137104/14 "2018-06-23T07:31:55Z")
PUT logstash-venkat PUT logstash-venkat/\_mapping/my\_type { "properties": { "geoip": { "properties": { "location": { "type": "geo\_point" } } } } } this works fine when I ran bin/logstash -f logstash-venkat.conf this gives the problem. If I first run bin/logstash -f logstash-venkat.conf it works fine. afterwards when I run the second mapping then it shows error. ---
**Author:** ![Venkatesan\_S\_Venkate](https://avatars.discourse-cdn.com/v4/letter/v/43a26b/32.png) [@Venkatesan\_S\_Venkate](https://discuss.elastic.co/u/Venkatesan_S_Venkate)\ **Post date:** [June 23, 2018, 8:13am UTC](https://discuss.elastic.co/t/logstash-data-not-visible-on-coordinate-map/137104/15 "2018-06-23T08:13:05Z")
Now I got this error { "error": { "root\_cause": [ { "type": "illegal\_argument\_exception", "reason": "mapper [geoip.location] of different type, current\_type [float], merged\_type [geo\_point]" } ], "type": "illegal\_argument\_exception", "reason": "mapper [geoip.location] of different type, current\_type [float], merged\_type [geo\_point]" }, "status": 400 } ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 23, 2018, 8:28am UTC](https://discuss.elastic.co/t/logstash-data-not-visible-on-coordinate-map/137104/16 "2018-06-23T08:28:09Z")
Stop indexing, delete and recreate the index with the correct mapping and the restart indexing. Or even better - create an index template with the correct mapping so it is automatically applied when a new index is created. ---
**Author:** ![Venkatesan\_S\_Venkate](https://avatars.discourse-cdn.com/v4/letter/v/43a26b/32.png) [@Venkatesan\_S\_Venkate](https://discuss.elastic.co/u/Venkatesan_S_Venkate)\ **Post date:** [June 23, 2018, 10:25am UTC](https://discuss.elastic.co/t/logstash-data-not-visible-on-coordinate-map/137104/17 "2018-06-23T10:25:43Z")
I got it after creating the following template PUT \_template/logstash { "index\_patterns": "logstash-\*", "settings": { "number\_of\_replicas": 1, "number\_of\_shards": 2 }, "mappings": { "log": { "dynamic": "true", "properties": { "geoip": { "dynamic": true, "properties": { "location": { "type": "geo\_point" } } } } } } } ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 21, 2018, 10:30am UTC](https://discuss.elastic.co/t/logstash-data-not-visible-on-coordinate-map/137104/18 "2018-07-21T10:30:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.