# org.elasticsearch.index.query.QueryShardException: failed to find geo\_point field \[geoip.location\]

**URL:** <https://discuss.elastic.co/t/org-elasticsearch-index-query-queryshardexception-failed-to-find-geo-point-field-geoip-location/155815>\
**Category:** Elasticsearch\
**Created:** [November 8, 2018, 4:08am UTC](https://discuss.elastic.co/t/org-elasticsearch-index-query-queryshardexception-failed-to-find-geo-point-field-geoip-location/155815 "2018-11-08T04:08:19Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![mauriciothomsen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mauriciothomsen/32/36507_2.png) [@mauriciothomsen](https://discuss.elastic.co/u/mauriciothomsen)\
**Post date:** [November 8, 2018, 4:08am UTC](https://discuss.elastic.co/t/org-elasticsearch-index-query-queryshardexception-failed-to-find-geo-point-field-geoip-location/155815/1 "2018-11-08T04:08:20Z")

</div>

When creating a new visualization using geohash aggregation, I get the following error:

"Courier fetch: 5 of 10 shards failed."

Monitoring the elasticsearch log when performing this action, I get the following line:

"org.elasticsearch.index.query.QueryShardException: failed to find geo\_point field [geoip.location]"

The weird thing: the map displays the circles correctly according to the data - derived from the ipaddress.

Here's my configuration:

On the **logstash filter section** :

geoip {  
source =\> "ip\_address"  
}

Checking the **document mapping** :

"ip": {  
"type": "ip"  
},  
"latitude": {  
"type": "half\_float"  
},  
"location": {  
"type": "geo\_point"  
},  
"longitude": {  
"type": "half\_float"  
},

Checking the **ingested data** :

geoip.location {  
"lon": -122.3422,  
"lat": 47.6344  
}

Since I can see the correct map, I would assume this kind of error should not occur. Any idea?

Thanks.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [November 9, 2018, 11:16am UTC](https://discuss.elastic.co/t/org-elasticsearch-index-query-queryshardexception-failed-to-find-geo-point-field-geoip-location/155815/2 "2018-11-09T11:16:52Z")

</div>

is it possible that you are searching across two indices, and only one of them has the field correctly mapped to a geo point?

---

<div class="post-metadata">

**Author:** ![mauriciothomsen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mauriciothomsen/32/36507_2.png) [@mauriciothomsen](https://discuss.elastic.co/u/mauriciothomsen)\
**Post date:** [November 10, 2018, 5:42pm UTC](https://discuss.elastic.co/t/org-elasticsearch-index-query-queryshardexception-failed-to-find-geo-point-field-geoip-location/155815/3 "2018-11-10T17:42:41Z")

</div>

Yeas, thought about that. To make sure I am doing the right thing, I deleted all indexes used on this search and just kept the newly created. Still got the same problem. Thanks.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [November 26, 2018, 3:37pm UTC](https://discuss.elastic.co/t/org-elasticsearch-index-query-queryshardexception-failed-to-find-geo-point-field-geoip-location/155815/4 "2018-11-26T15:37:37Z")

</div>

can you create a **fully** reproducible example under 6.5?

---

<div class="post-metadata">

**Author:** ![mauriciothomsen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mauriciothomsen/32/36507_2.png) [@mauriciothomsen](https://discuss.elastic.co/u/mauriciothomsen)\
**Post date:** [December 6, 2018, 2:00am UTC](https://discuss.elastic.co/t/org-elasticsearch-index-query-queryshardexception-failed-to-find-geo-point-field-geoip-location/155815/5 "2018-12-06T02:00:25Z")

</div>

For some mysterious reason, the issue just disappeared :-S

Although I'm glad not to see the error, I'm not comfortable not knowing what was done to solve it. I'm still using 6.3, didn't have the opportunity to upgrade to 6.5. Most probably I deleted all indexes and just ingested again in a fresh one, not an action that I would suggested as a good solution.

Thanks anyway for the support.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 3, 2019, 2:00am UTC](https://discuss.elastic.co/t/org-elasticsearch-index-query-queryshardexception-failed-to-find-geo-point-field-geoip-location/155815/6 "2019-01-03T02:00:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.