# Missing Geo\_point field in geohash aggregate -! Kibana 4.5

**URL:** <https://discuss.elastic.co/t/missing-geo-point-field-in-geohash-aggregate-kibana-4-5/68761>\
**Category:** Elasticsearch\
**Created:** [December 12, 2016, 8:00pm UTC](https://discuss.elastic.co/t/missing-geo-point-field-in-geohash-aggregate-kibana-4-5/68761 "2016-12-12T20:00:38Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bob\_Metelsky](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bob_metelsky/32/11387_2.png) [@Bob\_Metelsky](https://discuss.elastic.co/u/Bob_Metelsky)\
**Post date:** [December 12, 2016, 8:00pm UTC](https://discuss.elastic.co/t/missing-geo-point-field-in-geohash-aggregate-kibana-4-5/68761/1 "2016-12-12T20:00:38Z")

</div>

Guys, having a heck of a time creating a simple tile map

all files and configuration are here  
[https://sites.google.com/site/developtroubleshooting/elastic-geoip](https://sites.google.com/site/developtroubleshooting/elastic-geoip)

Im having a presentation tomorrow and I need to get a tile map by location.

Under allot of pressure to make this work

Thanks  
Bob

---

<div class="post-metadata">

**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\
**Post date:** [December 13, 2016, 12:18am UTC](https://discuss.elastic.co/t/missing-geo-point-field-in-geohash-aggregate-kibana-4-5/68761/2 "2016-12-13T00:18:24Z")

</div>

Try replacing your geoip filter in Logstash config

```auto
 geoip {
      source => "clientip"
      target => "geoip"
      database => "/etc/logstash/conf.d/GeoLiteCity.dat"
      add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
      add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
    }
    mutate {
      convert => ["[geoip][coordinates]", "float"]
    }

```

with this config

```auto
geoip {
            source => "clientip"
            target => "geoip"
}

```

Your mapping is ok so far, but you may have to delete existing indexes if you see field conflict error.

Start to send logs to Logstash again, and if you see something like this in the stdout, the geoip.location can be used in your Tile map.

```auto
geoip.location: [-78.1704, 38.71629999999999]

```

Make sure that geoip.location is mapped as geo\_point in your index.

---

<div class="post-metadata">

**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\
**Post date:** [December 13, 2016, 12:27am UTC](https://discuss.elastic.co/t/missing-geo-point-field-in-geohash-aggregate-kibana-4-5/68761/3 "2016-12-13T00:27:16Z")

</div>

Actually, your config seems to work too, as I see the geoip.location field contains appropriate data

```auto
"location" => [
            [0] -96.7885,
            [1] 39.08879999999999
        ]

```

However, the mapping for that field in Elasticsearch according to your [link](https://sites.google.com/site/developtroubleshooting/elastic-geoip/mapping) is number. It should be geo\_point.

---

<div class="post-metadata">

**Author:** ![Bob\_Metelsky](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bob_metelsky/32/11387_2.png) [@Bob\_Metelsky](https://discuss.elastic.co/u/Bob_Metelsky)\
**Post date:** [December 13, 2016, 1:22am UTC](https://discuss.elastic.co/t/missing-geo-point-field-in-geohash-aggregate-kibana-4-5/68761/4 "2016-12-13T01:22:24Z")

</div>

Hi Appreciate the help...

Made the suggested changes to the logstash.conf file, getting the same error

I get the geoip.location

better data 🙂 same error...

see error image, new conf file and output file  
[https://sites.google.com/site/developtroubleshooting/elastic-geoip/mapping2](https://sites.google.com/site/developtroubleshooting/elastic-geoip/mapping2)

---

<div class="post-metadata">

**Author:** ![Bob\_Metelsky](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bob_metelsky/32/11387_2.png) [@Bob\_Metelsky](https://discuss.elastic.co/u/Bob_Metelsky)\
**Post date:** [December 13, 2016, 1:41am UTC](https://discuss.elastic.co/t/missing-geo-point-field-in-geohash-aggregate-kibana-4-5/68761/5 "2016-12-13T01:41:49Z")

</div>

> [@anhlqn](#):
>
> can be used in your Tile map.

Hi - Also Im not sure what you mean with this...

"Make sure that geoip.location is mapped as geo\_point in your index"

How is that done?

---

<div class="post-metadata">

**Author:** ![Bob\_Metelsky](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bob_metelsky/32/11387_2.png) [@Bob\_Metelsky](https://discuss.elastic.co/u/Bob_Metelsky)\
**Post date:** [December 13, 2016, 1:42am UTC](https://discuss.elastic.co/t/missing-geo-point-field-in-geohash-aggregate-kibana-4-5/68761/6 "2016-12-13T01:42:49Z")

</div>

Also not sure what you mean with this...  
"Make sure that geoip.location is mapped as geo\_point in your index"  
How is that done?

---

<div class="post-metadata">

**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\
**Post date:** [December 13, 2016, 1:56am UTC](https://discuss.elastic.co/t/missing-geo-point-field-in-geohash-aggregate-kibana-4-5/68761/7 "2016-12-13T01:56:29Z")

</div>

> [@Bob\_Metelsky](#):
>
> see error image, new conf file and output filehttps://sites.google.com/site/developtroubleshooting/elastic-geoip/mapping2

I think the issue is that the mappings you specify in your `elasticsearch-output-plugin`, which is ` template => "/etc/logstash/conf.d/elasticsearch-apache-weblogs-geoip.json"` is not applied to your index named `bob`

Please try again with this output config for Logstash

```auto
output {
stdout { codec => rubydebug }
  elasticsearch {
    index => "apache-weblogs-geoip2"
    hosts => ["t400:9200"]
    manage_template => true
    template => "/etc/logstash/conf.d/elasticsearch-apache-weblogs-geoip.json"
    template_name => "apache-weblogs-geoip"
  }
}

```

> [@Bob\_Metelsky](#):
>
> Also not sure what you mean with this..."Make sure that geoip.location is mapped as geo\_point in your index"How is that done?

I believe your are on Elasticsearch 2.x. If so, you can install the Kopf plugin [GitHub - lmenezes/elasticsearch-kopf: web admin interface for elasticsearch](https://github.com/lmenezes/elasticsearch-kopf) to your elasticsearch to add and manage index mapping templates. More about mappings [Mapping | Elasticsearch: The Definitive Guide [2.x] | Elastic](https://www.elastic.co/guide/en/elasticsearch/guide/current/mapping-intro.html).

Your current mapping for geo.location is number  
 ![](https://us1.discourse-cdn.com/elastic/original/2X/9/980032e8551e095ef9d08304e82628eaf8c338ce.jpg)

but it is supposed to be geo\_point like this

![](https://us1.discourse-cdn.com/elastic/original/2X/9/96191dda448435ced3a2f19abcec94f136083356.jpg)

---

<div class="post-metadata">

**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\
**Post date:** [December 13, 2016, 5:05am UTC](https://discuss.elastic.co/t/missing-geo-point-field-in-geohash-aggregate-kibana-4-5/68761/8 "2016-12-13T05:05:29Z")

</div>

I wrote this guide about geoip a while ago [http://www.secureict.info/2015/11/process-netflow-with-nprobe-and\_20.html](http://www.secureict.info/2015/11/process-netflow-with-nprobe-and_20.html). I hope it clarifies about mapping geo\_point fields.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 10, 2017, 5:05am UTC](https://discuss.elastic.co/t/missing-geo-point-field-in-geohash-aggregate-kibana-4-5/68761/9 "2017-01-10T05:05:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.