Map geo_point field in Elasticsearch

[espogian]

Hi there.

I have defined a field named location which is an array with longitude and latitude.
I noticed that Logstash is indexing this field as a float and is not being recognized natively as geographical point in Elasticsearch.
I have tried to change the mapping as follows:

PUT _template/logstash
...
    "mappings": {
...
    "properties": {
...
		  "location": {
			"type": "geo_point"
		  },

The thing is working but I'm receiving a warning about the fact that index mapping is deprecated.
Which is the best practice now?
Also, it would be nice to have the field recognized as geographical point right at ingest time.

Thank you

[espogian]

I think I found a possible solution, mapping like this:

PUT _template/logstash
{
	"index_patterns": ["logstash-*"],
	"mappings": {
		"doc": {
			"properties": {
				"location": {
					"type": "geo_point"
				}
			}
		}
	}
}

[Badger]

This is the right approach, but that overwrites the template loaded by logstash. You should probably call the template something other than logstash.

[espogian]

Do you mean changing index_patterns?

[Badger]

No, I mean change the name of the template itself.

PUT _template/logstash-location

[espogian]

Thank you. What happens when I have two templates (logstash and logstash-location) which point to the same index-patterns?

[Badger]

The documentation covers this. If multiple templates match they are merged. You can control precedence with the order parameter.

[espogian]

Thank you, that was very useful!