Rollup: field referenced by a terms group must be a [numeric] or [keyword/text] type, but found [geo_point]

Elastic Stack Elasticsearch
1

I'd like to use the geoip.location field in my rollup, but I get this error. Is it a bug or am I going about this the wrong way? To be honest, this is more of a nice-to-have feature for us. It's not high priority.

{
  "error": {
    "root_cause": [
      {
        "type": "remote_transport_exception",
        "reason": "[mgr-elastic-003][148.251.47.231:9300][cluster:admin/xpack/rollup/put]"
      }
    ],
    "type": "illegal_argument_exception",
    "reason": "Validation Failed: 1: The field referenced by a terms group must be a [numeric] or [keyword/text] type, but found [geo_point] for field [geoip.location];"
  },
  "status": 400
}

Here's the JSON I used to create the index.

{
    "index_pattern": "mediaserver_20*",
    "rollup_index": "ms_5min_v4",
    "cron": "*/10 * * * * ?",
    "page_size" :10000,
    "groups" : {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "5m",
        "delay": "10m"
      },
      "terms": {
        "fields": ["account", "stream", "streamtype", "host", "http_host", "clientip_n_agent", "geoip.region_name", "geoip.country_name", "geoip.continent_code", "geoip.location", "cache_status", "response", "verb"]
      },
      "histogram": {
        "fields": ["request_time"],
        "interval": 1
      }
    },
    "metrics": [
        {
            "field": "bytes",
            "metrics": ["sum"]
        },
        {
            "field": "request_time",
            "metrics": ["avg","min","max"]
        }
    ]
}
2

Not a bug, just not supported yet. We don't support any geo datatypes in rollup right now.

3

That's cool I can live without geo datatypes.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.