I know replying to yourself is rude, but here is some more info.
I have the filebeat 7.8.0 template loaded, and matched to the incoming index. The template explicitly has (as an example) client.geo defined as:
"geo": {
"type": "object",
"properties": {
"city_name": {
"ignore_above": 1024,
"type": "keyword"
},
"continent_name": {
"ignore_above": 1024,
"type": "keyword"
},
"country_iso_code": {
"ignore_above": 1024,
"type": "keyword"
},
"country_name": {
"ignore_above": 1024,
"type": "keyword"
},
"location": {
"type": "geo_point"
},
When I point the Kibana discover-> map at that index, I get the error message:
Type query_shard_exception
Reason failed to find geo_point field [client.geo.location]
when I look at the settings for that index via the index management screen in Kibana I get:
"location": {
"properties": {
"lat": {
"type": "float"
},
"lon": {
"type": "float"
}
}
},
It appears that "something" has ignored the geo-point definition and just accepted the lat and lon as floats instead. The geoip lookup inside the pipeline is working, its just the mapping into the index that appears to be failing. Confused I am.