# My index contains all geo data but not showing in list while creating Maps from that index

**URL:** <https://discuss.elastic.co/t/my-index-contains-all-geo-data-but-not-showing-in-list-while-creating-maps-from-that-index/259196>\
**Category:** Kibana\
**Created:** [December 20, 2020, 4:30pm UTC](https://discuss.elastic.co/t/my-index-contains-all-geo-data-but-not-showing-in-list-while-creating-maps-from-that-index/259196 "2020-12-20T16:30:53Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![ankitdevnalkar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ankitdevnalkar/32/46158_2.png) [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\
**Post date:** [December 20, 2020, 4:30pm UTC](https://discuss.elastic.co/t/my-index-contains-all-geo-data-but-not-showing-in-list-while-creating-maps-from-that-index/259196/1 "2020-12-20T16:30:53Z")

</div>

I am performing Geo lookup via Logstash and added `geoip` filter to get required data. I am getting data in logs but some how it is not getting listed in indexes while configuring layers in Map. Here is my `conf` file.

```
input {
  http_poller {
    urls => {
      test2 => {
        method => get
        url => "https://api.cloudflare.com/client/v4/user/audit_logs"
        headers => {
            "X-Auth-Email" => "my@email.com"
            "X-Auth-Key" => "API Key"
            "Content-Type" => "application/json"
        }
     }
    }
	schedule => { cron => "* * * * * UTC"}
	codec => "json"
  }
}
filter {
split
                {
                        field => "result"
                }

mutate {
			add_field => { "foo_%{somefield}" => "Hello world, from %{[result][actor][email]}" }
		}
geoip
                {
                        source => "[result][actor][ip]"
                }

}
output {
        stdout { codec => rubydebug }
       elasticsearch {
	codec => json
	hosts => ["myhost:9200"]
	index => "cloudflare"	
	ssl => true
	ssl_certificate_verification => false
	user => 'elastic'
	password => password
   }
}

```

And here is geo data I am getting via logs. It is also showing these data in discover section in Kibana.

 ![geodata](https://us1.discourse-cdn.com/elastic/original/3X/3/0/30104522ca28bd90dec18dfa051125fb6ac20f16.png)

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [December 20, 2020, 4:42pm UTC](https://discuss.elastic.co/t/my-index-contains-all-geo-data-but-not-showing-in-list-while-creating-maps-from-that-index/259196/2 "2020-12-20T16:42:56Z")

</div>

Can you share you index mapping

```auto
GET cloudflare/_mapping

```

The followinf field should be mapped as `geo_point`

```auto
geoip.location

```

---

<div class="post-metadata">

**Author:** ![ankitdevnalkar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ankitdevnalkar/32/46158_2.png) [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\
**Post date:** [December 20, 2020, 5:29pm UTC](https://discuss.elastic.co/t/my-index-contains-all-geo-data-but-not-showing-in-list-while-creating-maps-from-that-index/259196/3 "2020-12-20T17:29:18Z")

</div>

@ylasri here it is (`GET cloudflare/_mapping`). I pasted limited fields due to character limit in editor here. Please let me know if you need all fields, I will add in a text file and send.

```
   {
  "cloudflare" : {
    "mappings" : {
      "properties" : {
        "@timestamp" : {
          "type" : "date"
        },
        "@version" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "foo_%{somefield}" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "geoip" : {
          "properties" : {
            "city_name" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "continent_code" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "country_code2" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "country_code3" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "country_name" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "ip" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "latitude" : {
              "type" : "float"
            },
            "location" : {
              "properties" : {
                "lat" : {
                  "type" : "float"
                },
                "lon" : {
                  "type" : "float"
                }
              }
            },
            "longitude" : {
              "type" : "float"
            },
            "postal_code" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "region_code" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "region_name" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "timezone" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            }
          }
        },
        "host" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "path" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "result" : {
          "properties" : {
            "action" : {
              "properties" : {
                "info" : {
                  "type" : "text",
                  "fields" : {
                    "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                    }
                  }
                },
                "result" : {
                  "type" : "boolean"
                },
                "type" : {
                  "type" : "text",
                  "fields" : {
                    "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                    }
                  }
                }
              }
            },
            "actor" : {
              "properties" : {
                "email" : {
                  "type" : "text",
                  "fields" : {
                    "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                    }
                  }
                },
                "id" : {
                  "type" : "text",
                  "fields" : {
                    "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                    }
                  }
                },
                "ip" : {
                  "type" : "text",
                  "fields" : {
                    "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                    }
                  }
                },
                "type" : {
                  "type" : "text",
                  "fields" : {
                    "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                    }
                  }
                }
              }
            },
            "id" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
```

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [December 20, 2020, 5:35pm UTC](https://discuss.elastic.co/t/my-index-contains-all-geo-data-but-not-showing-in-list-while-creating-maps-from-that-index/259196/4 "2020-12-20T17:35:35Z")

</div>

As said, you need to map correclty the field `geoip.location` as `geo_point`

here is an example for your index

```auto
PUT cloudflare
{
  "settings": {
    "number_of_replicas": 0,
    "number_of_shards": 1
  },
  "mappings": {
    "properties": {
      "@timestamp": {
        "type": "date"
      },
      "@version": {
        "type": "keyword"
      },
      "geoip": {
        "properties": {
          "city_name": {
            "type": "keyword"
          },
          "continent_code": {
            "type": "keyword"
          },
          "country_code2": {
            "type": "keyword"
          },
          "country_code3": {
            "type": "keyword"
          },
          "country_name": {
            "type": "keyword"
          },
          "ip": {
            "type": "keyword"
          },
          "location": {
            "type": "geo_point"
          },
          "postal_code": {
            "type": "keyword"
          },
          "region_code": {
            "type": "keyword"
          },
          "region_name": {
            "type": "keyword"
          },
          "timezone": {
            "type": "keyword"
          }
        }
      },
      "host": {
        "type": "keyword"
      },
      "path": {
        "type": "keyword"
      },
      "result": {
        "properties": {
          "action": {
            "properties": {
              "info": {
                "type": "keyword"
              },
              "result": {
                "type": "boolean"
              },
              "type": {
                "type": "keyword"
              }
            }
          },
          "actor": {
            "properties": {
              "email": {
                "type": "keyword"
              },
              "id": {
                "type": "keyword"
              },
              "ip": {
                "type": "keyword"
              },
              "type": {
                "type": "keyword"
              }
            }
          },
          "id": {
            "type": "keyword"
          }
        }
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![ankitdevnalkar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ankitdevnalkar/32/46158_2.png) [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\
**Post date:** [December 20, 2020, 5:41pm UTC](https://discuss.elastic.co/t/my-index-contains-all-geo-data-but-not-showing-in-list-while-creating-maps-from-that-index/259196/5 "2020-12-20T17:41:50Z")

</div>

Is there anyway I can put this conversion in logstash filter plugin ?

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [December 20, 2020, 6:13pm UTC](https://discuss.elastic.co/t/my-index-contains-all-geo-data-but-not-showing-in-list-while-creating-maps-from-that-index/259196/6 "2020-12-20T18:13:54Z")

</div>

No, logstash convert mutate filter support only some basic [types](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-convert)

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [December 20, 2020, 6:15pm UTC](https://discuss.elastic.co/t/my-index-contains-all-geo-data-but-not-showing-in-list-while-creating-maps-from-that-index/259196/7 "2020-12-20T18:15:34Z")

</div>

You can use logstash to [load your default](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-template) template for the index

---

<div class="post-metadata">

**Author:** ![ankitdevnalkar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ankitdevnalkar/32/46158_2.png) [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\
**Post date:** [December 20, 2020, 6:16pm UTC](https://discuss.elastic.co/t/my-index-contains-all-geo-data-but-not-showing-in-list-while-creating-maps-from-that-index/259196/8 "2020-12-20T18:16:42Z")

</div>

what can be the easiest work around for this ?

---

<div class="post-metadata">

**Author:** ![ankitdevnalkar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ankitdevnalkar/32/46158_2.png) [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\
**Post date:** [December 20, 2020, 7:31pm UTC](https://discuss.elastic.co/t/my-index-contains-all-geo-data-but-not-showing-in-list-while-creating-maps-from-that-index/259196/9 "2020-12-20T19:31:36Z")

</div>

I deleted my old index and created one with same name with following as I was on working on dev server. And now it works !

```
PUT cloudflare
{
  "settings": {
    "number_of_replicas": 0,
    "number_of_shards": 1
  },
  "mappings": {
    "properties": {
      "@timestamp": {
        "type": "date"
      },
      "@version": {
        "type": "keyword"
      },
      "geoip": {
        "properties": {
          "city_name": {
            "type": "keyword"
          },
          "continent_code": {
            "type": "keyword"
          },
          "country_code2": {
            "type": "keyword"
          },
          "country_code3": {
            "type": "keyword"
          },
          "country_name": {
            "type": "keyword"
          },
          "ip": {
            "type": "keyword"
          },
          "location": {
            "type": "geo_point"
          },
          "postal_code": {
            "type": "keyword"
          },
          "region_code": {
            "type": "keyword"
          },
          "region_name": {
            "type": "keyword"
          },
          "timezone": {
            "type": "keyword"
          }
        }
      },
      "host": {
        "type": "keyword"
      },
      "path": {
        "type": "keyword"
      },
      "result": {
        "properties": {
          "action": {
            "properties": {
              "info": {
                "type": "keyword"
              },
              "result": {
                "type": "boolean"
              },
              "type": {
                "type": "keyword"
              }
            }
          },
          "actor": {
            "properties": {
              "email": {
                "type": "keyword"
              },
              "id": {
                "type": "keyword"
              },
              "ip": {
                "type": "keyword"
              },
              "type": {
                "type": "keyword"
              }
            }
          },
          "id": {
            "type": "keyword"
          }
        }
      }
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 17, 2021, 7:31pm UTC](https://discuss.elastic.co/t/my-index-contains-all-geo-data-but-not-showing-in-list-while-creating-maps-from-that-index/259196/10 "2021-01-17T19:31:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.