Logstash Setup with GeoIP

The default template for an elasticsearch output defines the location field of an object called geoip to be a geo_point. That matches the default target for the geoip filter. If you use a different target then you need a different template.

You could build a geoip object like that, yes.