The index pattern <INDEX_NAME>* does not contain any of the following compatible field types: geo_point

ruranga · January 20, 2020, 8:47am

Hi,
When I try to create a visualization -> coordinated map by using geoip i'm getting below error

"The index pattern <INDEX_NAME>* does not contain any of the following compatible field types: geo_point"

But I'm getting below json out put in Kibana.

"geoip": {
  "continent_code": "NA",
  "country_code3": "US",
  "country_name": "United States",
  "longitude": -97.822,
  "location": {
    "lon": -97.822,
    "lat": 37.751
  },
  "timezone": "America/Chicago",
  "latitude": 37.751,
  "country_code2": "US",
  "ip": "104.75.84.8"
},

Also when check the Kibana -> DevTools -> GET /_template/logstash* I'm getting below

"geoip" : {
      "dynamic" : true,
      "properties" : {
        "ip" : {
          "type" : "ip"
        },
        "latitude" : {
          "type" : "half_float"
        },
        "location" : {
          "type" : "geo_point"
        },
        "longitude" : {
          "type" : "half_float"
        }
      }
    }

As per the documentation I should be able to create a Coordinated map. But I'm getting above mentioned error. Can some one help me to sort this?

Thanks in advance!

dadoonet · January 20, 2020, 9:07am

It's probably because you did not define the right mapping or your query is incorrect and does not use the right field.

Could you provide a full recreation script as described in About the Elasticsearch category. It will help to better understand what you are doing. Please, try to keep the example as simple as possible.

A full reproduction script will help readers to understand, reproduce and if needed fix your problem. It will also most likely help to get a faster answer.

ruranga · January 20, 2020, 9:23am

Dear dadoonet,
I have rectified my post as instructed.

dadoonet · January 20, 2020, 9:36am

Read again

Could you provide a full recreation script as described in About the Elasticsearch category. It will help to better understand what you are doing. Please, try to keep the example as simple as possible.

I'm highlighting the important part here:

A typical script like this one can be copied and pasted in Kibana Dev Console by any reader.

Here we can't just copy, paste and play and it would require some significant work for a reader to reproduce your case.

ruranga · January 20, 2020, 9:50am

I think I have provided what I have. Is there anything else that I should share?
If need can you pls specify?
Also pls note that I'm getting this error when creating a visualization. (I have inserted the screenshot)

Thanks in advance!

dadoonet · January 20, 2020, 10:10am

Ok.

What is the output of:

GET sampath_proxy_elk*/_mapping

ruranga · January 20, 2020, 10:28am

{
  "sampath_proxy_elk-proxy_bluecoat-2020.01.20" : {
    "mappings" : {
      "properties" : {
        "@timestamp" : {
          "type" : "date"
        },
        "@version" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "LOGTime" : {
          "type" : "date"
        },
        "c_ip" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "cs_auth_group" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "cs_categories" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "cs_host" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "cs_method" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "cs_threat_risk" : {
          "type" : "long"
        },
        "cs_uri_extension" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "cs_uri_path" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "cs_uri_port" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "cs_uri_query" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "cs_username" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "ecs" : {
          "properties" : {
            "version" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            }
          }
        },
        "geoip" : {
          "properties" : {
            "city_name" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "continent_code" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "country_code2" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "country_code3" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "country_name" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "dma_code" : {
              "type" : "long"
            },
            "ip" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "latitude" : {
              "type" : "float"
            },
            "location" : {
              "properties" : {
                "lat" : {
                  "type" : "float"
                },
                "lon" : {
                  "type" : "float"
                }
              }
            },
            "longitude" : {
              "type" : "float"
            },
            "postal_code" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "region_code" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "region_name" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "timezone" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            }
          }
        },
        "proxy_ip" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "r_ip" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "rs_content_type" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "s_action" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "sc_filter_result" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "sc_status" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "type" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "x_bluecoat_application_groups" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "x_bluecoat_application_name" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "x_bluecoat_application_operation" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "x_exception_id" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "x_virus_id" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        }
      }
    }
  }
}

dadoonet · January 20, 2020, 10:51am

I think you have the answer here:

        "location" : {
          "properties" : {
            "lat" : {
              "type" : "float"
            },
            "lon" : {
              "type" : "float"
            }
          }
        },

location is not a geo_point.

ruranga · January 20, 2020, 10:52am

Dear dadoonet,
Thank you very much!!!
But how can I change it?

Thanks in advance

dadoonet · January 20, 2020, 11:21am

You can't "change" it.
You need to correctly create your index in the first place. Then you could reindex your existing data.

It mostly depends on what tool you are using to index your data.

ruranga · January 20, 2020, 11:42am

Dear,
I'm using logstash. Shall I share my logstash configuration?

Thanks!

dadoonet · January 20, 2020, 1:08pm

Did you define a mapping for elasticsearch? Or a template?
I believe you didn't.

You can do that from kibana dev console or from logstash using template parameter. See https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-template

Some information about templates: https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html

system · February 17, 2020, 1:08pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
The index pattern does not contain any of the following compatible field types: geo_point Kibana	3	603	August 18, 2019
Geo_point issue, need help in identifying the issue Elasticsearch	5	686	December 26, 2019
GeoIP data present but cannot be displayed Kibana	10	1628	May 16, 2018
Error when trying to add documents layer to maps Kibana maps	6	577	September 16, 2020
[geoip.location is not of type geo_point] Index pattern does not contain any of the following field types: geo_point Elasticsearch	4	10206	August 31, 2017

The index pattern <INDEX_NAME>* does not contain any of the following compatible field types: geo_point

Related Topics