# Template mapping examples not clear for geoip

**URL:** https://discuss.elastic.co/t/template-mapping-examples-not-clear-for-geoip/165832
**Category:** Logstash
**Created:** [January 25, 2019, 11:31pm UTC](https://discuss.elastic.co/t/template-mapping-examples-not-clear-for-geoip/165832 "2019-01-25T23:31:44Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![CharlieBrown](https://avatars.discourse-cdn.com/v4/letter/c/c4cdca/32.png) [@CharlieBrown](https://discuss.elastic.co/u/CharlieBrown)
#### Post date: [January 25, 2019, 11:31pm UTC](https://discuss.elastic.co/t/template-mapping-examples-not-clear-for-geoip/165832/1 "2019-01-25T23:31:44Z")

</div>

I have tried searching the web for answers but lately it seems that most search engines return completely unrelated results. Therefore I registered so I can ask real people for some help.

The instructions here: [https://www.elastic.co/blog/logstash\_lesson\_elasticsearch\_mapping](https://www.elastic.co/blog/logstash_lesson_elasticsearch_mapping)

Are great up to the point where i have a .json file that is improperly formatted. Without an example of a complete mapping I can't seem to fit those code snippets in the proper order with correct syntax. In short, it's unclear to me how to copy/pasta those examples into a valid .json file.

Curl fails with :  
{  
"error": {  
"reason": "request body is required",  
"root\_cause": [  
{  
"reason": "request body is required",  
"type": "parse\_exception"  
}  
],  
"type": "parse\_exception"  
},  
"status": 400  
}

all I really want to do at this point is set the data type for the location or geopoint field which as I understand is a concatenation of lat/long.

If anyone can point me in the right direction I would really appreciate the help. Also, I apparently have a lot to learn about json format so any pointers there would be great too.

Thanks!

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 26, 2019, 1:14am UTC](https://discuss.elastic.co/t/template-mapping-examples-not-clear-for-geoip/165832/2 "2019-01-26T01:14:58Z")

</div>

[This](https://discuss.elastic.co/t/location-dosent-convert-to-geo-point/131199) thread might help.

---

<div class="post-metadata">

### Author: ![CharlieBrown](https://avatars.discourse-cdn.com/v4/letter/c/c4cdca/32.png) [@CharlieBrown](https://discuss.elastic.co/u/CharlieBrown)
#### Post date: [January 28, 2019, 5:30pm UTC](https://discuss.elastic.co/t/template-mapping-examples-not-clear-for-geoip/165832/3 "2019-01-28T17:30:34Z")

</div>

Thank you Badger! That did in fact work to create the mapping to data type however, my field (geoip.coordinates) which is a concatenation of geoip.latitude and geoip.longitude is not .

I will keep stumbling through it. My IQ is just too low to be messing with this. I guess Burger King needs some janitors.

Thank you for your response Badger ;-D

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 28, 2019, 5:36pm UTC](https://discuss.elastic.co/t/template-mapping-examples-not-clear-for-geoip/165832/4 "2019-01-28T17:36:04Z")

</div>

Can you call your field just "geoip"? That field is mapped as a geo\_point by the default mapping.

---

<div class="post-metadata">

### Author: ![CharlieBrown](https://avatars.discourse-cdn.com/v4/letter/c/c4cdca/32.png) [@CharlieBrown](https://discuss.elastic.co/u/CharlieBrown)
#### Post date: [January 28, 2019, 5:48pm UTC](https://discuss.elastic.co/t/template-mapping-examples-not-clear-for-geoip/165832/5 "2019-01-28T17:48:39Z")

</div>

I changed it to the following:

```
  geoip {
     source => "clientip"
     target => "geoip"

```

add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ]  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ]  
add\_tag =\> ["apache-geoip"]  
}

I say the field is "geoip.coordinates" because that's how the two lat/long points "merged" into one field (named geoip.coordinates)

Can you tell anything from this filter rule in logstash/conf.d/12-apache\_filter.conf ?

---

<div class="post-metadata">

### Author: ![CharlieBrown](https://avatars.discourse-cdn.com/v4/letter/c/c4cdca/32.png) [@CharlieBrown](https://discuss.elastic.co/u/CharlieBrown)
#### Post date: [January 28, 2019, 5:55pm UTC](https://discuss.elastic.co/t/template-mapping-examples-not-clear-for-geoip/165832/6 "2019-01-28T17:55:21Z")

</div>

Maybe this is working now. I have a field named geoip.location and it's now being populated with coordinates like so:

{  
"lon": -97.822,  
"lat": 37.751  
}

This may be what I've been looking for. Thank you for your help Badger!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 25, 2019, 5:55pm UTC](https://discuss.elastic.co/t/template-mapping-examples-not-clear-for-geoip/165832/7 "2019-02-25T17:55:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
