# "nginx-access-\*" index pattern does not contain any of the following field types: geo\_point
**URL:** https://discuss.elastic.co/t/nginx-access-index-pattern-does-not-contain-any-of-the-following-field-types-geo-point/85398
**Category:** Elasticsearch
**Created:** [May 11, 2017, 12:48pm UTC](https://discuss.elastic.co/t/nginx-access-index-pattern-does-not-contain-any-of-the-following-field-types-geo-point/85398 "2017-05-11T12:48:04Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@aarishramesh](https://discuss.elastic.co/u/aarishramesh)
#### Post date: [May 11, 2017, 12:48pm UTC](https://discuss.elastic.co/t/nginx-access-index-pattern-does-not-contain-any-of-the-following-field-types-geo-point/85398/1 "2017-05-11T12:48:04Z")
I get the above error while trying to create tile map visualization based on nginx client ip. I have set up ELK to log my nginx access logs. Have defined a custom index pattern in my filebeat.yml like below
```
- input_type: log
# Paths that should be crawled and fetched. Glob based paths.
paths:
- /var/log/nginx/access.log
document_type: nginx-access
```
And here is logstash.conf
```
input {
beats {
port => 5044
}
}
filter {
grok {
match => ["message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra_fields}"]
overwrite => ["message"]
}
mutate {
convert => ["response", "integer"]
convert => ["bytes", "integer"]
convert => ["responsetime", "float"]
}
geoip {
source => "clientip"
target => "geoip"
add_tag => ["nginx-geoip"]
}
mutate {
convert => ["[geoip][coordinates]", "float"]
}
date {
match => ["timestamp" , "dd/MMM/YYYY:HH:mm:ss Z"]
remove_field => ["timestamp"]
}
useragent {
source => "agent"
}
}
output {
stdout { codec => rubydebug }
if [type] == "nginx-access" {
elasticsearch {
hosts => localhost
index => "nginx-access-%{+YYYY.MM.dd}"
}
```
}
Also on checking index template for nginx-access I see the geoip.location data type being float
{"nginx-access-2017.05.09":{"aliases":{},"mappings":{"nginx-access":{"properties":{"@timestamp":{"type":"date"},"@version":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}},"agent":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}},"auth":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}},"beat":{"properties":{"hostname":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}},"name":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}},"version":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}}}},"bytes":{"type":"long"},"clientip":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}},"device":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}}
> ,"geoip":{"properties":{"continent\_code":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}},"country\_code2":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}},"country\_code3":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}},"country\_name":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}},"ip":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}},"latitude":{"type":"float"},"location":{"type":"float"},"longitude":{"type":"float"}
So do i need to define a template to convert geoip.location field type to geopoint ? Or can someone lemme know how do i fix this ?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 11, 2017, 1:16pm UTC](https://discuss.elastic.co/t/nginx-access-index-pattern-does-not-contain-any-of-the-following-field-types-geo-point/85398/2 "2017-05-11T13:16:32Z")
[https://www.elastic.co/blog/geoip-in-the-elastic-stack](https://www.elastic.co/blog/geoip-in-the-elastic-stack) has some good resources to assist.
---
### Author:  [@aarishramesh](https://discuss.elastic.co/u/aarishramesh)
#### Post date: [May 11, 2017, 2:09pm UTC](https://discuss.elastic.co/t/nginx-access-index-pattern-does-not-contain-any-of-the-following-field-types-geo-point/85398/3 "2017-05-11T14:09:51Z")
I went through the resource. Also tried overriding the default template
with the config like mentioned below
```
template => "/filebeat-index-template.json"
template_overwrite => true
```
Here is the filebeat-index-template.json file
{
"mappings": {
"_default_": {
"\_all": {
"enabled": true,
"norms": {
"enabled": false
}
},
"dynamic\_templates": [
{
"template1": {
"mapping": {
"doc\_values": true,
"ignore\_above": 1024,
"index": "not\_analyzed",
"type": "{dynamic\_type}"
},
"match": "_"
}
}
],
"properties": {
"@timestamp": {
"type": "date"
},
"message": {
"type": "string",
"index": "analyzed"
},
"offset": {
"type": "long",
"doc\_values": "true"
},
"geoip" : {
"type" : "object",
"dynamic": true,
"properties" : {
"location" : { "type" : "geo\_point" }
}
}
}
}
},
"settings": {
"index.refresh\_interval": "5s"
},
"template": "filebeat-_"
}
Reference: [https://github.com/elastic/logstash/issues/2952](https://github.com/elastic/logstash/issues/2952)
Still I am getting geoip.location saved as number instead of geopoint in the new index created. Am i doing something wrong here ?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 13, 2017, 3:49am UTC](https://discuss.elastic.co/t/nginx-access-index-pattern-does-not-contain-any-of-the-following-field-types-geo-point/85398/4 "2017-05-13T03:49:28Z")
> [@aarishramesh](#):
>
> template =\> "/filebeat-index-template.json"
Is that the actual path?
---
### Author:  [@aarishramesh](https://discuss.elastic.co/u/aarishramesh)
#### Post date: [May 15, 2017, 11:58am UTC](https://discuss.elastic.co/t/nginx-access-index-pattern-does-not-contain-any-of-the-following-field-types-geo-point/85398/5 "2017-05-15T11:58:09Z")
Yes i mentioned the correct path for filebeat-index-template.json in template.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 12, 2017, 12:10pm UTC](https://discuss.elastic.co/t/nginx-access-index-pattern-does-not-contain-any-of-the-following-field-types-geo-point/85398/6 "2017-06-12T12:10:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.