I am pulling in my firewall logs into ELK and i am trying to use the tile map to map out entries. Logstash parses all the information correctly but when i go to use the tile map it says that i don't have any field types with "geo_point". I checked my mappings and geoip.location was set to type float. I went ahead and added an index mapping so that when it came in it would be set to geo_point but Kibana still doesn't recognize it. I deleted the index and let it re-create and it still doesn't recognize. Am i missing something simple. I have attached some screen shots of the data. I am running 5.2.1 on all ELK components.
Link to photos
You need to create the right mapping before indexing.
Please don't post pictures.
Sorry for the pictures, i thought they might be helpful. I tried putting a mutate clause in my logstash config but it doesn't seem to like that. Any suggestions on this?
> mutate { convert => { "[geoip] [location]" => "geo_point" } }
I'm not sure it's related to logstash here.
What does a document is looking like?
What is your mapping looking like?
You can use markdown style like to format your code:
```
CODE
```This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.