LogStash, GeoJSON and Kibana

The default template that an elasticsearch output uses maps a field called [geoip] to include a [geoip][location] which is a geo_point. [geoip] matches the default target of a geoip filter, so yes, that one get mapped "automatically".

If you do not set the mapping no other field will be a geo_point. I understand that dynamic mapping is really helpful, that's why it is there. But remember, you can still use dynamic mapping for everything else except your geo_point fields.

Note also that you may not even need to know where in your document structure those geo_points are if you can name them consistently. The dynamic template documentation includes an example that shows how anything that arrives in elasticsearch as a string and whose name starts with "ip" can be mapped as type ip. I have not tested it but I expect that you could create a template that maps any field whose name ends in "location" as a geo_point.

And remember that when sending a geo_point to elastic you do not have to send it as an array of two floats. You have five options, including a string like "41.12,-71.34". elasticsearch knows how to parse that once the field is mapped as a geo_point.

2 Likes