# Logstash Geohash Question **URL:** \ **Category:** Elasticsearch\ **Created:** [March 6, 2015, 10:10pm UTC](https://discuss.elastic.co/t/logstash-geohash-question/22567 "2015-03-06T22:10:45Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![David\_Kleiner](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@David\_Kleiner](https://discuss.elastic.co/u/David_Kleiner)\ **Post date:** [March 6, 2015, 10:10pm UTC](https://discuss.elastic.co/t/logstash-geohash-question/22567/1 "2015-03-06T22:10:45Z")
Hi, Are there any plans to add calculating geohash to Logstash? Now that Kibana4 is out and won't accept geo coordinates for its map visualization... Thanks, David -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/47a6dfbe-b7bd-4de0-8720-ab34cc5eb350%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/47a6dfbe-b7bd-4de0-8720-ab34cc5eb350%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [March 7, 2015, 12:26am UTC](https://discuss.elastic.co/t/logstash-geohash-question/22567/2 "2015-03-07T00:26:40Z")
Can you elaborate? I use the geoip filter all the time with kb4 and have no problems On 07/03/2015 9:10 am, "David Kleiner" [david.kleiner@gmail.com](mailto:david.kleiner@gmail.com) wrote: > Hi, > > Are there any plans to add calculating geohash to Logstash? Now that > Kibana4 is out and won't accept geo coordinates for its map > visualization... > > Thanks, > > David > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/47a6dfbe-b7bd-4de0-8720-ab34cc5eb350%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/47a6dfbe-b7bd-4de0-8720-ab34cc5eb350%40googlegroups.com) > [https://groups.google.com/d/msgid/elasticsearch/47a6dfbe-b7bd-4de0-8720-ab34cc5eb350%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/47a6dfbe-b7bd-4de0-8720-ab34cc5eb350%40googlegroups.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAEYi1X\_ZMU0XpJ-4ZiCacKjjqOaXxF4PE9FMTbDQdk0-GdXgsg%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEYi1X_ZMU0XpJ-4ZiCacKjjqOaXxF4PE9FMTbDQdk0-GdXgsg%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![David\_Kleiner](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@David\_Kleiner](https://discuss.elastic.co/u/David_Kleiner)\ **Post date:** [March 7, 2015, 12:38am UTC](https://discuss.elastic.co/t/logstash-geohash-question/22567/3 "2015-03-07T00:38:56Z")
Sure. When I try to create a tile map, the only aggregation field that shows up in the left panel for geo coordinates is of type geohash, which I don't have in the index, see screenshot. On Friday, March 6, 2015 at 4:27:01 PM UTC-8, Mark Walkom wrote: > Can you elaborate? I use the geoip filter all the time with kb4 and have > no problems > On 07/03/2015 9:10 am, "David Kleiner" \<[david....@gmail.com](mailto:david....@gmail.com) \\> > wrote: > > > Hi, > > > > Are there any plans to add calculating geohash to Logstash? Now that > > Kibana4 is out and won't accept geo coordinates for its map > > visualization... > > > > Thanks, > > > > David > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \. > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/47a6dfbe-b7bd-4de0-8720-ab34cc5eb350%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/47a6dfbe-b7bd-4de0-8720-ab34cc5eb350%40googlegroups.com) > > [https://groups.google.com/d/msgid/elasticsearch/47a6dfbe-b7bd-4de0-8720-ab34cc5eb350%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/47a6dfbe-b7bd-4de0-8720-ab34cc5eb350%40googlegroups.com?utm_medium=email&utm_source=footer) > > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/5ed8c78b-761b-4b14-b18e-f9b16d85d828%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/5ed8c78b-761b-4b14-b18e-f9b16d85d828%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![David\_Kleiner](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@David\_Kleiner](https://discuss.elastic.co/u/David_Kleiner)\ **Post date:** [March 7, 2015, 12:50am UTC](https://discuss.elastic.co/t/logstash-geohash-question/22567/4 "2015-03-07T00:50:31Z")
And here are my geoip fields: geoip: { - properties: { - dma\_code: { - type: long } - continent\_code: { - type: string } - city\_name: { - type: string } - location: { - type: double } - area\_code: { - type: long } - country\_name: { - type: string } - ip: { - type: string } - region\_name: { - type: string } - timezone: { - type: string } - postal\_code: { - type: string } - country\_code2: { - type: string } - country\_code3: { - type: string } - longitude: { - type: double } - latitude: { - type: double } - real\_region\_name: { - type: string } } } On Friday, March 6, 2015 at 4:38:56 PM UTC-8, David Kleiner wrote: > Sure. > > When I try to create a tile map, the only aggregation field that shows up > in the left panel for geo coordinates is of type geohash, which I don't > have in the index, see screenshot. > > On Friday, March 6, 2015 at 4:27:01 PM UTC-8, Mark Walkom wrote: > > > Can you elaborate? I use the geoip filter all the time with kb4 and have > > no problems > > On 07/03/2015 9:10 am, "David Kleiner" [david....@gmail.com](mailto:david....@gmail.com) wrote: > > > > > Hi, > > > > > > Are there any plans to add calculating geohash to Logstash? Now that > > > Kibana4 is out and won't accept geo coordinates for its map > > > visualization... > > > > > > Thanks, > > > > > > David > > > > > > -- > > > You received this message because you are subscribed to the Google > > > Groups "elasticsearch" group. > > > To unsubscribe from this group and stop receiving emails from it, send > > > an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com). > > > To view this discussion on the web visit > > > [https://groups.google.com/d/msgid/elasticsearch/47a6dfbe-b7bd-4de0-8720-ab34cc5eb350%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/47a6dfbe-b7bd-4de0-8720-ab34cc5eb350%40googlegroups.com) > > > [https://groups.google.com/d/msgid/elasticsearch/47a6dfbe-b7bd-4de0-8720-ab34cc5eb350%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/47a6dfbe-b7bd-4de0-8720-ab34cc5eb350%40googlegroups.com?utm_medium=email&utm_source=footer) > > > . > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/1e0688ed-d97e-474a-a44f-68cfbfd04922%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/1e0688ed-d97e-474a-a44f-68cfbfd04922%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [March 7, 2015, 3:39pm UTC](https://discuss.elastic.co/t/logstash-geohash-question/22567/5 "2015-03-07T15:39:46Z")
ES needs a single lat+lon field to read. It or KB won't combine things. On 06/03/2015 4:38 pm, "David Kleiner" [david.kleiner@gmail.com](mailto:david.kleiner@gmail.com) wrote: > Sure. > > When I try to create a tile map, the only aggregation field that shows up > in the left panel for geo coordinates is of type geohash, which I don't > have in the index, see screenshot. > > On Friday, March 6, 2015 at 4:27:01 PM UTC-8, Mark Walkom wrote: > > > Can you elaborate? I use the geoip filter all the time with kb4 and have > > no problems > > On 07/03/2015 9:10 am, "David Kleiner" [david....@gmail.com](mailto:david....@gmail.com) wrote: > > > > > Hi, > > > > > > Are there any plans to add calculating geohash to Logstash? Now that > > > Kibana4 is out and won't accept geo coordinates for its map > > > visualization... > > > > > > Thanks, > > > > > > David > > > > > > -- > > > You received this message because you are subscribed to the Google > > > Groups "elasticsearch" group. > > > To unsubscribe from this group and stop receiving emails from it, send > > > an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com). > > > To view this discussion on the web visit [https://groups.google.com/d/](https://groups.google.com/d/) > > > msgid/elasticsearch/47a6dfbe-b7bd-4de0-8720-ab34cc5eb350% > > > [40googlegroups.com](http://40googlegroups.com) > > > [https://groups.google.com/d/msgid/elasticsearch/47a6dfbe-b7bd-4de0-8720-ab34cc5eb350%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/47a6dfbe-b7bd-4de0-8720-ab34cc5eb350%40googlegroups.com?utm_medium=email&utm_source=footer) > > > . > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/5ed8c78b-761b-4b14-b18e-f9b16d85d828%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/5ed8c78b-761b-4b14-b18e-f9b16d85d828%40googlegroups.com) > > [https://groups.google.com/d/msgid/elasticsearch/5ed8c78b-761b-4b14-b18e-f9b16d85d828%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/5ed8c78b-761b-4b14-b18e-f9b16d85d828%40googlegroups.com?utm_medium=email&utm_source=footer) > > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAEYi1X-8UUh9NB1SWFOUgxPg3K74mvFRpsxA9ucLGG%3DmOEAkmg%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEYi1X-8UUh9NB1SWFOUgxPg3K74mvFRpsxA9ucLGG%3DmOEAkmg%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Michael\_6](https://avatars.discourse-cdn.com/v4/letter/m/ec9cab/32.png) [@Michael\_6](https://discuss.elastic.co/u/Michael_6)\ **Post date:** [March 17, 2015, 4:07pm UTC](https://discuss.elastic.co/t/logstash-geohash-question/22567/6 "2015-03-17T16:07:22Z")
What do you mean exactly? These are the fields I'm able to obtain, whereas geoip.coordinates is built by using add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ] add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ] in my logstash.conf. geoip.city\_name Warsaw_t_geoip.continent\_code EU\*#_geoip.coordinates ["21.0","52.25"]tgeoip.country\_code2 PL_t_geoip.country\_code3 POL_t\* geoip.country\_name Poland_t_geoip.ip 217.67.205.50\*#_geoip.latitude 52.25_#\* geoip.location [21,52.25]_#geoip.longitude 21t_geoip.real\_region\_name Mazowieckie_t_geoip.region\_name 78_t_geoip.timezone Europe/Warsaw Can please be so kind and post the part of your geoip filter in your logstash.conf where handle the building of fields in order to use in tile map of kb4? Thanks in advance Am Samstag, 7. März 2015 16:40:07 UTC+1 schrieb Mark Walkom: > ES needs a single lat+lon field to read. It or KB won't combine things -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/633b740d-1f9d-43ed-acdd-670e30829503%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/633b740d-1f9d-43ed-acdd-670e30829503%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [March 17, 2015, 4:44pm UTC](https://discuss.elastic.co/t/logstash-geohash-question/22567/7 "2015-03-17T16:44:05Z")
It'll be able to read geoip.coordinates if you point to it. On 17 March 2015 at 09:07, Michael [bunszz@gmail.com](mailto:bunszz@gmail.com) wrote: > What do you mean exactly? > > These are the fields I'm able to obtain, whereas geoip.coordinates is > built by using > > add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ] > add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ] > > in my logstash.conf. > > geoip.city\_name Warsaw_t_geoip.continent\_code EU\*#_geoip.coordinates > ["21.0","52.25"]tgeoip.country\_code2 PL_t_geoip.country\_code3 POL_t\* > geoip.country\_name Poland_t_geoip.ip 217.67.205.50\*#_geoip.latitude 52.25 > #geoip.location [21,52.25]#geoip.longitude 21tgeoip.real\_region\_name > Mazowieckie_t_geoip.region\_name 78_t\*geoip.timezone Europe/Warsaw > Can please be so kind and post the part of your geoip filter in your > logstash.conf where handle the building of fields in order to use in tile > map of kb4? > > Thanks in advance > > Am Samstag, 7. März 2015 16:40:07 UTC+1 schrieb Mark Walkom: > > > ES needs a single lat+lon field to read. It or KB won't combine things > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/633b740d-1f9d-43ed-acdd-670e30829503%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/633b740d-1f9d-43ed-acdd-670e30829503%40googlegroups.com) > [https://groups.google.com/d/msgid/elasticsearch/633b740d-1f9d-43ed-acdd-670e30829503%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/633b740d-1f9d-43ed-acdd-670e30829503%40googlegroups.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAEYi1X9ytHKCe5SkTwC9ZPkSBkA%2Bn8cTdBCZq99TZqYqA7cCCg%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEYi1X9ytHKCe5SkTwC9ZPkSBkA%2Bn8cTdBCZq99TZqYqA7cCCg%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Michael\_6](https://avatars.discourse-cdn.com/v4/letter/m/ec9cab/32.png) [@Michael\_6](https://discuss.elastic.co/u/Michael_6)\ **Post date:** [March 18, 2015, 9:45am UTC](https://discuss.elastic.co/t/logstash-geohash-question/22567/8 "2015-03-18T09:45:06Z")
Unfortunately not. I have the same problem what David described with his screenshot. The only aggregation that shows up in the left panel for geo coordinates is of type geohash and below there is no field to choose at all. Am Dienstag, 17. März 2015 17:44:32 UTC+1 schrieb Mark Walkom: > It'll be able to read geoip.coordinates if you point to it. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/5053a865-9f16-414d-a253-0ebe30de885c%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/5053a865-9f16-414d-a253-0ebe30de885c%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Michael\_6](https://avatars.discourse-cdn.com/v4/letter/m/ec9cab/32.png) [@Michael\_6](https://discuss.elastic.co/u/Michael_6)\ **Post date:** [March 18, 2015, 10:02am UTC](https://discuss.elastic.co/t/logstash-geohash-question/22567/9 "2015-03-18T10:02:29Z")
Do I have to add some extra fields to the coordinates field as described in [http://www.tagwith.com/question\_345822\_kibana-3-geojson-vs-kibana4-geohash/](http://www.tagwith.com/question_345822_kibana-3-geojson-vs-kibana4-geohash/) ? Problem here is that the logstash.conf does not seem to like 3-dim arrays ... add\_field =\> ["[geoip][coordinates][lat\_lon]", true ] does not work at all. Perhaps I'mm wrong with the syntax? -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/18e0d443-c143-46b7-839c-612d4b0028fa%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/18e0d443-c143-46b7-839c-612d4b0028fa%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Michael\_6](https://avatars.discourse-cdn.com/v4/letter/m/ec9cab/32.png) [@Michael\_6](https://discuss.elastic.co/u/Michael_6)\ **Post date:** [March 18, 2015, 2:36pm UTC](https://discuss.elastic.co/t/logstash-geohash-question/22567/10 "2015-03-18T14:36:23Z")
Ok, seems I resolved the issue: In short: You have to use the default output index in logstash: output { elasticsearch { host =\> "localhost" protocol =\> "http" } } in ES this results in the index logstash-YYYY.MM.DD Since I try to deal with syslogs, I thought it was a good idea to create a dedicated index. output { if [type] == "syslog" { elasticsearch { host =\> "localhost" index =\> "syslog-%{+YYYY.MM.dd}" protocol =\> "http" } } else { elasticsearch { host =\> "localhost" protocol =\> "http" } } The thing is: Now the autmatic mapping feature of logstash (described here [http://logstash.net/docs/1.4.2/filters/geoip](http://logstash.net/docs/1.4.2/filters/geoip)) is not taken into account. So, it may be possible to manually create a mapping template (see [http://logstash.net/docs/1.4.2/filters/geoip](http://logstash.net/docs/1.4.2/filters/geoip) ... manage\_template / template) in the logstash output config. Or you can stick to the default output index of logstash. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/d0cda794-a6cd-4f45-bf46-38cf80967c74%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/d0cda794-a6cd-4f45-bf46-38cf80967c74%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [March 18, 2015, 8:46pm UTC](https://discuss.elastic.co/t/logstash-geohash-question/22567/11 "2015-03-18T20:46:24Z")
That sounds really weird, I have a non-LS index with geopoints and I can definitely read and plot these in KB4. Are you running the latest KB4 release? What version of ES? On 18 March 2015 at 07:36, Michael [bunszz@gmail.com](mailto:bunszz@gmail.com) wrote: > Ok, seems I resolved the issue: > > In short: You have to use the default output index in logstash: > > output { > elasticsearch { > host =\> "localhost" > protocol =\> "http" > } > } > > in ES this results in the index logstash-YYYY.MM.DD > > Since I try to deal with syslogs, I thought it was a good idea to create a > dedicated index. > > output { > if [type] == "syslog" { > elasticsearch { > host =\> "localhost" > index =\> "syslog-%{+YYYY.MM.dd}" > protocol =\> "http" > } > } else { > elasticsearch { > host =\> "localhost" > protocol =\> "http" > } > } > > The thing is: Now the autmatic mapping feature of logstash (described here > [Geoip filter plugin | Logstash Reference [8.11] | Elastic](http://logstash.net/docs/1.4.2/filters/geoip)) is not taken into account. > So, it may be possible to manually create a mapping template (see > [Geoip filter plugin | Logstash Reference [8.11] | Elastic](http://logstash.net/docs/1.4.2/filters/geoip) ... manage\_template / > template) in the logstash output config. > Or you can stick to the default output index of logstash. > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/d0cda794-a6cd-4f45-bf46-38cf80967c74%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/d0cda794-a6cd-4f45-bf46-38cf80967c74%40googlegroups.com) > [https://groups.google.com/d/msgid/elasticsearch/d0cda794-a6cd-4f45-bf46-38cf80967c74%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/d0cda794-a6cd-4f45-bf46-38cf80967c74%40googlegroups.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAEYi1X9-wZdUYCG3pBOFgauBeHSKhy1NONh\_n7nPJLZ%3Dqf-W2A%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEYi1X9-wZdUYCG3pBOFgauBeHSKhy1NONh_n7nPJLZ%3Dqf-W2A%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![David\_Kleiner](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@David\_Kleiner](https://discuss.elastic.co/u/David_Kleiner)\ **Post date:** [March 18, 2015, 9:01pm UTC](https://discuss.elastic.co/t/logstash-geohash-question/22567/12 "2015-03-18T21:01:30Z")
In my case, it's ES 1.4.4, KB4 4.0.1, I use logstash-forwarder to logstash-forwarder input, rabbitmq output, geoip filter in logstash and ES river plugin, no template. Perhaps I should've created a dedicated template but I now have 3 years worth of index data and reindexing it will be painful. On Wednesday, March 18, 2015 at 1:46:51 PM UTC-7, Mark Walkom wrote: > That sounds really weird, I have a non-LS index with geopoints and I can > definitely read and plot these in KB4. > > Are you running the latest KB4 release? What version of ES? > > On 18 March 2015 at 07:36, Michael \<[bun...@gmail.com](mailto:bun...@gmail.com) \\> wrote: > > > Ok, seems I resolved the issue: > > > > In short: You have to use the default output index in logstash: > > > > output { > > elasticsearch { > > host =\> "localhost" > > protocol =\> "http" > > } > > } > > > > in ES this results in the index logstash-YYYY.MM.DD > > > > Since I try to deal with syslogs, I thought it was a good idea to create > > a dedicated index. > > > > output { > > if [type] == "syslog" { > > elasticsearch { > > host =\> "localhost" > > index =\> "syslog-%{+YYYY.MM.dd}" > > protocol =\> "http" > > } > > } else { > > elasticsearch { > > host =\> "localhost" > > protocol =\> "http" > > } > > } > > > > The thing is: Now the autmatic mapping feature of logstash (described > > here [Geoip filter plugin | Logstash Reference [8.11] | Elastic](http://logstash.net/docs/1.4.2/filters/geoip)) is not taken into > > account. > > So, it may be possible to manually create a mapping template (see > > [Geoip filter plugin | Logstash Reference [8.11] | Elastic](http://logstash.net/docs/1.4.2/filters/geoip) ... manage\_template / > > template) in the logstash output config. > > Or you can stick to the default output index of logstash. > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \. > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/d0cda794-a6cd-4f45-bf46-38cf80967c74%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/d0cda794-a6cd-4f45-bf46-38cf80967c74%40googlegroups.com) > > [https://groups.google.com/d/msgid/elasticsearch/d0cda794-a6cd-4f45-bf46-38cf80967c74%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/d0cda794-a6cd-4f45-bf46-38cf80967c74%40googlegroups.com?utm_medium=email&utm_source=footer) > > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/4c92e0d1-68f4-4e45-af96-d89eac4bd914%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/4c92e0d1-68f4-4e45-af96-d89eac4bd914%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 12:25am UTC](https://discuss.elastic.co/t/logstash-geohash-question/22567/13 "2017-07-06T00:25:43Z")