# Map geoip.location to geo\_point by default

**URL:** https://discuss.elastic.co/t/map-geoip-location-to-geo-point-by-default/35055
**Category:** Logstash
**Created:** [November 19, 2015, 1:19pm UTC](https://discuss.elastic.co/t/map-geoip-location-to-geo-point-by-default/35055 "2015-11-19T13:19:34Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![jonblack](https://avatars.discourse-cdn.com/v4/letter/j/a8b319/32.png) [@jonblack](https://discuss.elastic.co/u/jonblack)
#### Post date: [November 19, 2015, 1:19pm UTC](https://discuss.elastic.co/t/map-geoip-location-to-geo-point-by-default/35055/1 "2015-11-19T13:19:34Z")

</div>

I'm trying to visualise geoip location on a tile map in Kibana but am getting the following error:

> No Compatible Fields: The "[logstash-nginx-access-]YYYY.MM.DD" index pattern does not contain any of the following field types: geo\_point

I found [this issue](https://github.com/elastic/logstash/issues/3137) on GitHub that describes the exact problem. It proposes a solution of prefixing the index with `logstash-`, which is what the template matches on; however, my index is already prefixed correctly:

```
output {
    if [type] == "nginx_access" {
        elasticsearch {
            hosts => "localhost:9200"
            sniffing => true
            manage_template => false
            index => "logstash-nginx-access-%{+YYYY.MM.dd}"
            document_type => "%{[@metadata][type]}"
        }
    }
}

```

Is anything else I need to get logstash to use the default template for elasticsearch or another way to have geoip data correctly mapped?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 19, 2015, 1:46pm UTC](https://discuss.elastic.co/t/map-geoip-location-to-geo-point-by-default/35055/2 "2015-11-19T13:46:48Z")

</div>

Have you reloaded the fields in Kibana? Have you checked how location.geoip actually is mapped for the index in question (use the get mapping API)?

---

<div class="post-metadata">

### Author: ![jonblack](https://avatars.discourse-cdn.com/v4/letter/j/a8b319/32.png) [@jonblack](https://discuss.elastic.co/u/jonblack)
#### Post date: [November 19, 2015, 1:51pm UTC](https://discuss.elastic.co/t/map-geoip-location-to-geo-point-by-default/35055/3 "2015-11-19T13:51:32Z")

</div>

Yes, I've tried reloading the index in Kibana. I've also removed the setting and re-added it, but in both cases the geoip fields weren't mapped to `geo_point`.

Running `curl 'localhost:9200/logstash-nginx-access-2015.11.19/_mapping?pretty=true` outputs the following. You can see that the `geoip.location` field is given a `double` type, as in the GitHub issue.

```
{
  "logstash-nginx-access-2015.11.19" : {
    "mappings" : {
      "nginx_access" : {
        "properties" : {
          "@timestamp" : {
            "type" : "date",
            "format" : "strict_date_optional_time||epoch_millis"
          },
          "@version" : {
            "type" : "string"
          },
          "agent" : {
            "type" : "string"
          },
          "auth" : {
            "type" : "string"
          },
          "bytes" : {
            "type" : "string"
          },
          "clientip" : {
            "type" : "string"
          },
          "count" : {
            "type" : "long"
          },
          "fileinfo" : {
            "type" : "object"
          },
          "geoip" : {
            "properties" : {
              "area_code" : {
                "type" : "long"
              },
              "city_name" : {
                "type" : "string"
              },
              "continent_code" : {
                "type" : "string"
              },
              "country_code2" : {
                "type" : "string"
              },
              "country_code3" : {
                "type" : "string"
              },
              "country_name" : {
                "type" : "string"
              },
              "dma_code" : {
                "type" : "long"
              },
              "ip" : {
                "type" : "string"
              },
              "latitude" : {
                "type" : "double"
              },
              "location" : {
                "type" : "double"
              },
              "longitude" : {
                "type" : "double"
              },
              "real_region_name" : {
                "type" : "string"
              },
              "region_name" : {
                "type" : "string"
              },
              "timezone" : {
                "type" : "string"
              }
            }
          },
          "httpversion" : {
            "type" : "string"
          },
          "ident" : {
            "type" : "string"
          },
          "input_type" : {
            "type" : "string"
          },
          "line" : {
            "type" : "long"
          },
          "message" : {
            "type" : "string"
          },
          "offset" : {
            "type" : "long"
          },
          "referrer" : {
            "type" : "string"
          },
          "request" : {
            "type" : "string"
          },
          "response" : {
            "type" : "string"
          },
          "shipper" : {
            "type" : "string"
          },
          "source" : {
            "type" : "string"
          },
          "tags" : {
            "type" : "string"
          },
          "timestamp" : {
            "type" : "string"
          },
          "type" : {
            "type" : "string"
          },
          "verb" : {
            "type" : "string"
          }
        }
      }
    }
  }
}
```

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 19, 2015, 3:01pm UTC](https://discuss.elastic.co/t/map-geoip-location-to-geo-point-by-default/35055/4 "2015-11-19T15:01:43Z")

</div>

You've set `manage_template` to false, so are you in fact managing the templates yourself? Is there a template in ES that will be applied to logstash-nginx-access-2015.11.19? Check with the index template APIs. If things look okay there, what happens if you create, say, logstash-nginx-access-2015.12.01? Will its mappings look alright?

---

<div class="post-metadata">

### Author: ![jonblack](https://avatars.discourse-cdn.com/v4/letter/j/a8b319/32.png) [@jonblack](https://discuss.elastic.co/u/jonblack)
#### Post date: [November 19, 2015, 3:50pm UTC](https://discuss.elastic.co/t/map-geoip-location-to-geo-point-by-default/35055/5 "2015-11-19T15:50:46Z")

</div>

`manage_template` was the problem, thanks. It's not clear at first glance who is managing the template when that's set to `true`. I assumed setting it to `true` meant that I was managing it, which I didn't want. Thanks.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:22am UTC](https://discuss.elastic.co/t/map-geoip-location-to-geo-point-by-default/35055/6 "2017-07-06T05:22:10Z")

</div>


