# No geo\_point fields logstash 6
**URL:** https://discuss.elastic.co/t/no-geo-point-fields-logstash-6/111788
**Category:** Logstash
**Created:** [December 14, 2017, 2:24pm UTC](https://discuss.elastic.co/t/no-geo-point-fields-logstash-6/111788 "2017-12-14T14:24:51Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@prophoto](https://discuss.elastic.co/u/prophoto)
#### Post date: [December 14, 2017, 2:24pm UTC](https://discuss.elastic.co/t/no-geo-point-fields-logstash-6/111788/1 "2017-12-14T14:24:51Z")
> **No Compatible Fields:** The "apache-access\_\*" index pattern does not contain any of the following field types: geo\_point
Logstash geo config that worked fine for logstash 5.6
```
geoip {
source => "clientip"
target => "geoip"
add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
}
mutate {
convert => ["[geoip][coordinates]", "float"]
}
```
---
### Author:  [@prophoto](https://discuss.elastic.co/u/prophoto)
#### Post date: [December 15, 2017, 2:23pm UTC](https://discuss.elastic.co/t/no-geo-point-fields-logstash-6/111788/2 "2017-12-15T14:23:57Z")
bump
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 18, 2017, 7:02am UTC](https://discuss.elastic.co/t/no-geo-point-fields-logstash-6/111788/3 "2017-12-18T07:02:18Z")
Do you use an index template that maps `[geoip][coordinates]` as geo\_point?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [December 18, 2017, 7:11am UTC](https://discuss.elastic.co/t/no-geo-point-fields-logstash-6/111788/4 "2017-12-18T07:11:26Z")
Please see [https://www.elastic.co/blog/geoip-in-the-elastic-stack](https://www.elastic.co/blog/geoip-in-the-elastic-stack) for common issues with this.
---
### Author:  [@prophoto](https://discuss.elastic.co/u/prophoto)
#### Post date: [December 18, 2017, 2:48pm UTC](https://discuss.elastic.co/t/no-geo-point-fields-logstash-6/111788/5 "2017-12-18T14:48:23Z")
This quote from the article leads me to believe that I don't have to worry about Elasticsearch, is that correct?
> What this all means is that any field called geoip.location, which is how we refer to these nested fields, that is sent to Elasticsearch will be automatically mapped as a geo\_point.
---
### Author:  [@prophoto](https://discuss.elastic.co/u/prophoto)
#### Post date: [December 18, 2017, 2:48pm UTC](https://discuss.elastic.co/t/no-geo-point-fields-logstash-6/111788/6 "2017-12-18T14:48:40Z")
How do I check?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 18, 2017, 3:10pm UTC](https://discuss.elastic.co/t/no-geo-point-fields-logstash-6/111788/7 "2017-12-18T15:10:24Z")
> This quote from the article leads me to believe that I don't have to worry about Elasticsearch, is that correct?
No, because of
> Assuming we are using the default Logstash or Filebeat index name pattern ...
at the beginning of the paragraph.
> How do I check?
If you haven't uploaded such an index template yourself it's safe to assume you don't have one. You should either
- not override the default index name in your elasticsearch output, or
- make sure you have an index template that gets applied to the indexes you use and that maps fields according to your needs.
---
### Author:  [@prophoto](https://discuss.elastic.co/u/prophoto)
#### Post date: [December 19, 2017, 7:36pm UTC](https://discuss.elastic.co/t/no-geo-point-fields-logstash-6/111788/8 "2017-12-19T19:36:59Z")
Can you give me an idea of index template I need to apply?
---
### Author:  [@prophoto](https://discuss.elastic.co/u/prophoto)
#### Post date: [December 28, 2017, 5:41pm UTC](https://discuss.elastic.co/t/no-geo-point-fields-logstash-6/111788/9 "2017-12-28T17:41:39Z")
Will this work?
PUT \_template/apache-template
{
"index\_patterns" : ["apache\*"],
"geoip" : {
"dynamic": true,
"properties" : {
"ip": { "type": "ip" },
"location" : { "type" : "geo\_point" },
"latitude" : { "type" : "half\_float" },
"longitude" : { "type" : "half\_float" }
}
}
}
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [December 28, 2017, 7:55pm UTC](https://discuss.elastic.co/t/no-geo-point-fields-logstash-6/111788/10 "2017-12-28T19:55:59Z")
That looks like it should work.
Otherwise just use an index pattern of `logstash-apache-` in your pipeline.
---
### Author:  [@prophoto](https://discuss.elastic.co/u/prophoto)
#### Post date: [January 3, 2018, 4:00pm UTC](https://discuss.elastic.co/t/no-geo-point-fields-logstash-6/111788/11 "2018-01-03T16:00:49Z")
Negative, this didn't work. "clientip" is the field containing requestor's ip address.
PUT \_template/apache-template
{
"index\_patterns" : ["apache\*"],
"geoip" : {
"dynamic": true,
"properties" : {
"clientip": { "type": "ip" },
"location" : { "type" : "geo\_point" },
"latitude" : { "type" : "half\_float" },
"longitude" : { "type" : "half\_float" }
}
}
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 3, 2018, 6:59pm UTC](https://discuss.elastic.co/t/no-geo-point-fields-logstash-6/111788/12 "2018-01-03T18:59:53Z")
What's the name of the index you've been using for testing this? What do the actual mappings of that index look like? What does an example document look like?
---
### Author:  [@prophoto](https://discuss.elastic.co/u/prophoto)
#### Post date: [January 5, 2018, 3:20pm UTC](https://discuss.elastic.co/t/no-geo-point-fields-logstash-6/111788/13 "2018-01-05T15:20:35Z")
Mapping...I have indexes for apache-access\_YYYY.MM.DD and apache-error\_YYYY.MM.DD. I tried to paste my mapping but got an error saying posts are limited to xxx characters. Preferred way to show you mapping?
---
### Author:  [@prophoto](https://discuss.elastic.co/u/prophoto)
#### Post date: [January 5, 2018, 3:24pm UTC](https://discuss.elastic.co/t/no-geo-point-fields-logstash-6/111788/14 "2018-01-05T15:24:58Z")
Doc.
```
{
```
"\_index": "apache-access\_2017.12.10",
"\_type": "doc",
"_id": "zkvKPWABk5VwT0Rv22O_",
"\_version": 1,
"\_score": null,
"\_source": {
"request": "/",
"server": "aws9",
"agent": ""Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_13\_1) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0.1 Safari/604.3.5"",
"source": "/var/log/httpd/access\_log",
"logline": "8.8.8.8- - [10/Dec/2017:00:19:50 +0000] [domiain.com](http://domiain.com) "GET / HTTP/1.1" 200 17962 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_13\_1) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0.1 Safari/604.3.5" Server=zws9 "TLSv1.2" 413255 0",
"request\_duration\_ms": 413255,
"clientip": "8.8.8.8",
"@version": "1",
"beat": {
"name": "[aws9.domain.net](http://aws9.domain.net)",
"hostname": "[aws9.domain.net](http://aws9.domain.net)",
"version": "6.0.0"
},
"host": "[aws9.domian.net](http://aws9.domian.net)",
"virtualhost": "[domain.com](http://domain.com)",
"ssl\_protocol": "TLSv1.2",
"user\_agent": {
"patch": "1",
"os": "Mac OS X",
"major": "11",
"minor": "0",
"build": "",
"os\_minor": "13",
"os\_major": "10",
"name": "Safari",
"os\_name": "Mac OS X",
"device": "Other"
},
"timestamp": "10/Dec/2017:00:19:50 +0000",
"geoip": {
"timezone": "America/New\_York",
"ip": "8.8.8.8",
"latitude": 39.9193,
"coordinates": [
-75.419,
39.9193
],
"continent\_code": "NA",
"city\_name": "Media",
"country\_name": "United States",
"country\_code2": "US",
"dma\_code": 504,
"country\_code3": "US",
"region\_name": "Pennsylvania",
"location": {
"lon": -75.419,
"lat": 39.9193
},
"postal\_code": "19063",
"region\_code": "PA",
"longitude": -75.419
},
"offset": 24178299,
"verb": "GET",
"message": "8.8.8.8 - - [10/Dec/2017:00:19:50 +0000] [domain.com](http://domain.com) "GET / HTTP/1.1" 200 17962 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_13\_1) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0.1 Safari/604.3.5" Server=aws9 "TLSv1.2" 413255 0",
"tags": [
"beats\_input\_codec\_plain\_applied"
],
"referrer": ""-"",
"@timestamp": "2017-12-10T00:19:50.000Z",
"response": "200",
"bytes": 17962,
"httpversion": "1.1",
"request\_duration\_s": 0
},
"fields": {
"@timestamp": [
"2017-12-10T00:19:50.000Z"
]
},
"highlight": {
"clientip": [
"@kibana-highlighted-field@8.8.8.8@/kibana-highlighted-field@"
],
"virtualhost": [
"@kibana-highlighted-field@domain.com@/kibana-highlighted-field@"
]
},
"sort": [
1512865190000
]
}
---
### Author:  [@prophoto](https://discuss.elastic.co/u/prophoto)
#### Post date: [January 5, 2018, 3:28pm UTC](https://discuss.elastic.co/t/no-geo-point-fields-logstash-6/111788/15 "2018-01-05T15:28:59Z")
> [@warkolm](#):
>
> Otherwise just use an index pattern of logstash-apache- in your pipeline.
I wouldn't mind doing that but I have tons of dashboards, visualizations and saved searches setup to use the current index pattern. If there was an easy way to change them I'd be all for it!
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [January 5, 2018, 8:03pm UTC](https://discuss.elastic.co/t/no-geo-point-fields-logstash-6/111788/16 "2018-01-05T20:03:21Z")
Given you are using a non-logstash based index pattern, you will need to edit the default logstash template and make sure the index pattern matches your custom one.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 5, 2018, 9:09pm UTC](https://discuss.elastic.co/t/no-geo-point-fields-logstash-6/111788/17 "2018-01-05T21:09:44Z")
> PUT \_template/apache-template
> {
> "index\_patterns" : ["apache\*"],
> "geoip" : {
> "dynamic": true,
> "properties" : {
> "clientip": { "type": "ip" },
> "location" : { "type" : "geo\_point" },
> "latitude" : { "type" : "half\_float" },
> "longitude" : { "type" : "half\_float" }
> }
> }
> }
That's not a valid index template. See the example at [Index templates | Elasticsearch Guide [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html) and compare the structure to what you have.
---
### Author:  [@prophoto](https://discuss.elastic.co/u/prophoto)
#### Post date: [January 11, 2018, 10:24pm UTC](https://discuss.elastic.co/t/no-geo-point-fields-logstash-6/111788/18 "2018-01-11T22:24:04Z")
Is this it?
PUT \_template/apache-template
{
"index\_patterns" : ["apache\*"],
"mappings": {
"geoip" : {
"dynamic": true,
"properties" : {
"clientip": { "type": "ip" },
"location" : { "type" : "geo\_point" },
"latitude" : { "type" : "half\_float" },
"longitude" : { "type" : "half\_float" }
}
}
}
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 18, 2018, 9:53pm UTC](https://discuss.elastic.co/t/no-geo-point-fields-logstash-6/111788/19 "2018-01-18T21:53:58Z")
Not quite, unless "geoip" is the name of your document type. Study the example again, and note how the subitem of "mappings" is the document type.
---
### Author:  [@prophoto](https://discuss.elastic.co/u/prophoto)
#### Post date: [January 27, 2018, 5:16pm UTC](https://discuss.elastic.co/t/no-geo-point-fields-logstash-6/111788/20 "2018-01-27T17:16:42Z")
I've looked over this a number of times on different occasions and don't see the issue, please help.
[Next page](https://discuss.elastic.co/t/no-geo-point-fields-logstash-6/111788.md?page=2)