I'd like to use the geoip.location field in my rollup, but I get this error. Is it a bug or am I going about this the wrong way? To be honest, this is more of a nice-to-have feature for us. It's not high priority.
{
"error": {
"root_cause": [
{
"type": "remote_transport_exception",
"reason": "[mgr-elastic-003][148.251.47.231:9300][cluster:admin/xpack/rollup/put]"
}
],
"type": "illegal_argument_exception",
"reason": "Validation Failed: 1: The field referenced by a terms group must be a [numeric] or [keyword/text] type, but found [geo_point] for field [geoip.location];"
},
"status": 400
}
Here's the JSON I used to create the index.
{
"index_pattern": "mediaserver_20*",
"rollup_index": "ms_5min_v4",
"cron": "*/10 * * * * ?",
"page_size" :10000,
"groups" : {
"date_histogram": {
"field": "@timestamp",
"interval": "5m",
"delay": "10m"
},
"terms": {
"fields": ["account", "stream", "streamtype", "host", "http_host", "clientip_n_agent", "geoip.region_name", "geoip.country_name", "geoip.continent_code", "geoip.location", "cache_status", "response", "verb"]
},
"histogram": {
"fields": ["request_time"],
"interval": 1
}
},
"metrics": [
{
"field": "bytes",
"metrics": ["sum"]
},
{
"field": "request_time",
"metrics": ["avg","min","max"]
}
]
}