The index pattern <INDEX_NAME>* does not contain any of the following compatible field types: geo_point

ruranga · January 20, 2020, 8:47am

Hi,
When I try to create a visualization -> coordinated map by using geoip i'm getting below error

"The index pattern <INDEX_NAME>* does not contain any of the following compatible field types: geo_point"

But I'm getting below json out put in Kibana.

"geoip": {
  "continent_code": "NA",
  "country_code3": "US",
  "country_name": "United States",
  "longitude": -97.822,
  "location": {
    "lon": -97.822,
    "lat": 37.751
  },
  "timezone": "America/Chicago",
  "latitude": 37.751,
  "country_code2": "US",
  "ip": "104.75.84.8"
},

Also when check the Kibana -> DevTools -> GET /_template/logstash* I'm getting below

"geoip" : {
      "dynamic" : true,
      "properties" : {
        "ip" : {
          "type" : "ip"
        },
        "latitude" : {
          "type" : "half_float"
        },
        "location" : {
          "type" : "geo_point"
        },
        "longitude" : {
          "type" : "half_float"
        }
      }
    }

As per the documentation I should be able to create a Coordinated map. But I'm getting above mentioned error. Can some one help me to sort this?

Thanks in advance!

dadoonet · January 20, 2020, 9:07am

It's probably because you did not define the right mapping or your query is incorrect and does not use the right field.

Could you provide a full recreation script as described in About the Elasticsearch category. It will help to better understand what you are doing. Please, try to keep the example as simple as possible.

A full reproduction script will help readers to understand, reproduce and if needed fix your problem. It will also most likely help to get a faster answer.

ruranga · January 20, 2020, 9:23am

Dear dadoonet,
I have rectified my post as instructed.

dadoonet · January 20, 2020, 9:36am

Read again

Could you provide a full recreation script as described in About the Elasticsearch category. It will help to better understand what you are doing. Please, try to keep the example as simple as possible.

I'm highlighting the important part here:

A typical script like this one can be copied and pasted in Kibana Dev Console by any reader.

Here we can't just copy, paste and play and it would require some significant work for a reader to reproduce your case.

ruranga · January 20, 2020, 9:50am

I think I have provided what I have. Is there anything else that I should share?
If need can you pls specify?
Also pls note that I'm getting this error when creating a visualization. (I have inserted the screenshot)

Thanks in advance!

dadoonet · January 20, 2020, 10:10am

Ok.

What is the output of:

GET sampath_proxy_elk*/_mapping

ruranga · January 20, 2020, 10:28am

{
  "sampath_proxy_elk-proxy_bluecoat-2020.01.20" : {
    "mappings" : {
      "properties" : {
        "@timestamp" : {
          "type" : "date"
        },
        "@version" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "LOGTime" : {
          "type" : "date"
        },
        "c_ip" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "cs_auth_group" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "cs_categories" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "cs_host" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "cs_method" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "cs_threat_risk" : {
          "type" : "long"
        },
        "cs_uri_extension" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "cs_uri_path" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "cs_uri_port" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "cs_uri_query" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "cs_username" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "ecs" : {
          "properties" : {
            "version" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            }
          }
        },
        "geoip" : {
          "properties" : {
            "city_name" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "continent_code" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "country_code2" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "country_code3" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "country_name" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "dma_code" : {
              "type" : "long"
            },
            "ip" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "latitude" : {
              "type" : "float"
            },
            "location" : {
              "properties" : {
                "lat" : {
                  "type" : "float"
                },
                "lon" : {
                  "type" : "float"
                }
              }
            },
            "longitude" : {
              "type" : "float"
            },
            "postal_code" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "region_code" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "region_name" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "timezone" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            }
          }
        },
        "proxy_ip" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "r_ip" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "rs_content_type" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "s_action" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "sc_filter_result" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "sc_status" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "type" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "x_bluecoat_application_groups" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "x_bluecoat_application_name" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "x_bluecoat_application_operation" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "x_exception_id" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "x_virus_id" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        }
      }
    }
  }
}

dadoonet · January 20, 2020, 10:51am

I think you have the answer here:

        "location" : {
          "properties" : {
            "lat" : {
              "type" : "float"
            },
            "lon" : {
              "type" : "float"
            }
          }
        },

location is not a geo_point.

ruranga · January 20, 2020, 10:52am

Dear dadoonet,
Thank you very much!!!
But how can I change it?

Thanks in advance

dadoonet · January 20, 2020, 11:21am

You can't "change" it.
You need to correctly create your index in the first place. Then you could reindex your existing data.

It mostly depends on what tool you are using to index your data.

ruranga · January 20, 2020, 11:42am

Dear,
I'm using logstash. Shall I share my logstash configuration?

Thanks!

dadoonet · January 20, 2020, 1:08pm

Did you define a mapping for elasticsearch? Or a template?
I believe you didn't.

You can do that from kibana dev console or from logstash using template parameter. See https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-template

Some information about templates: https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html

system · February 17, 2020, 1:08pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
The index pattern does not contain any of the following compatible field types: geo_point Kibana	3	603	August 18, 2019
Geo_point issue, need help in identifying the issue Elasticsearch	5	687	December 26, 2019
Cannot create Tile Map visualization Kibana	5	846	September 1, 2017
GeoIP data present but cannot be displayed Kibana	10	1632	May 16, 2018
Kibana4: geo_point Kibana	3	728	July 6, 2017

The index pattern <INDEX_NAME>* does not contain any of the following compatible field types: geo_point

Related topics