# Logstash load of geo data from lat, long - Kibana not recognising geo

**URL:** <https://discuss.elastic.co/t/logstash-load-of-geo-data-from-lat-long-kibana-not-recognising-geo/26928>\
**Category:** Logstash\
**Created:** [August 5, 2015, 10:16pm UTC](https://discuss.elastic.co/t/logstash-load-of-geo-data-from-lat-long-kibana-not-recognising-geo/26928 "2015-08-05T22:16:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![karijd](https://avatars.discourse-cdn.com/v4/letter/k/9f8e36/32.png) [@karijd](https://discuss.elastic.co/u/karijd)\
**Post date:** [August 5, 2015, 10:16pm UTC](https://discuss.elastic.co/t/logstash-load-of-geo-data-from-lat-long-kibana-not-recognising-geo/26928/1 "2015-08-05T22:16:51Z")

</div>

Hi,  
I am having trouble getting Kibana to recognise my geo data as proper geo data which it can plot.  
I have done lots of searching for the answer but I cannot seem to get the logstash.conf file to work. The time column acq is picked up a time but the geo is ignored. I have tried a few different variations from other posts but it is not working. I think it is as I need to map the geo or something but all examples for that I have seen are not showing the logstash conf file.  
Help would be much appreciated!

input {  
file {  
path =\> "/home/ubuntu/subset.csv"  
type =\> "core2"  
start\_position =\> "beginning"  
}  
}

filter {  
csv {  
columns =\> ["mmsi","lon","lat","sog","cog","hdg","acq","id","geo"]  
separator =\> ","  
}

if [id] == "id"{  
drop {}  
} else {  
mutate {  
convert =\> { "lon" =\> "float" }  
convert =\> { "lat" =\> "float" }  
}

mutate {  
rename =\> {  
"lon" =\> "[location][lon]"  
"lat" =\> "[location][lat]"  
}  
}

```
mutate {
  remove_field => ["message", "host", "@timestamp", "@version"]
}

```

geoip {  
source =\> "[lat,lon]"  
}  
}  
}

output {  
elasticsearch {  
action =\> "index"  
host =\> "localhost"  
index =\> "logstash-1"  
workers =\> 1  
}  
stdout {  
codec =\> rubydebug  
#codec =\> dots  
}  
}

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 7, 2015, 4:05am UTC](https://discuss.elastic.co/t/logstash-load-of-geo-data-from-lat-long-kibana-not-recognising-geo/26928/2 "2015-08-07T04:05:52Z")

</div>

You can't do a geoip filter on two fields like that, you need to merge `lon` and `lat` into a single field for it to work 🙂

---

<div class="post-metadata">

**Author:** ![karijd](https://avatars.discourse-cdn.com/v4/letter/k/9f8e36/32.png) [@karijd](https://discuss.elastic.co/u/karijd)\
**Post date:** [August 9, 2015, 3:26pm UTC](https://discuss.elastic.co/t/logstash-load-of-geo-data-from-lat-long-kibana-not-recognising-geo/26928/3 "2015-08-09T15:26:10Z")

</div>

Thanks Mark,  
I have merged the lon and lat, which works and creates a value like 35, -5. But the geoip.location variable is empty and the geo\_point is still greyed out in the tile map view. Can you see what I am doing wrong, I have tried a few things but still not working.. please help ☹

input {  
file {  
path =\> "/home/ubuntu/subset.csv"  
type =\> "core2"  
start\_position =\> "beginning"  
}  
}

filter {  
csv {  
columns =\> ["mmsi","callsign","imo","vessel","cargotype","activitytype","navigationalstatus","shiptype","maxdraught","vesseltypeindx","length","beam","lon","lat","sog","cog","hdg","acq","id","geo"]  
separator =\> ","  
}

if [id] == "id"{  
drop {}  
} else {  
mutate {  
convert =\> { "lon" =\> "float" }  
convert =\> { "lat" =\> "float" }  
}

mutate {  
replace =\> ["geo","%{lat},%{lon}"]  
}

```
mutate {
  remove_field => ["message", "host", "@timestamp", "@version"]
}

```

geoip {  
source =\> "geo"  
target =\> "geoip"  
}

}  
}

output {  
elasticsearch {  
action =\> "index"  
host =\> "localhost"  
index =\> "logstash-1"  
workers =\> 1  
}  
stdout {  
codec =\> rubydebug  
#codec =\> dots  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:32am UTC](https://discuss.elastic.co/t/logstash-load-of-geo-data-from-lat-long-kibana-not-recognising-geo/26928/4 "2017-07-06T05:32:30Z")

</div>