Although I am having all the information regarding geo locations but when I am trying to visualize it in kibana it says:
No Compatible Fields: The logstash_apchelogs index pattern does not contain any of the following field types:geo_point
What's the mapping of the index?
mapping???
can you please elaborate
I guess you required this info?!!!!
{
"logstash_apchelogs" : {
"mappings" : {
"doc" : {
"properties" : {
"@timestamp" : {
"type" : "date"
},
"@version" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"agent" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"auth" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"bytes" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"clientip" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"geoip" : {
"properties" : {
"city_name" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"continent_code" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"country_code2" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"country_code3" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"country_name" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"dma_code" : {
"type" : "long"
},
"ip" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"latitude" : {
"type" : "float"
},
"location" : {
"properties" : {
"lat" : {
"type" : "float"
},
"lon" : {
"type" : "float"
}
}
},
"longitude" : {
"type" : "float"
},
"postal_code" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"region_code" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"region_name" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"timezone" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"host" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"httpversion" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"ident" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"message" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"path" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"rawrequest" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"referrer" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"request" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"response" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"tags" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"timestamp" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"verb" : {
Please format your code/logs/config using the </> button, or markdown style back ticks. It helps to make things easy to read which helps us help you 
You don 't have anything that is mapped as a geopoint, so there is nothing for Kibana to use
That is what you need to fix..
so there has to be a field named as geo point???? because i used same grok earlier also and i was able to plot it on geo map
It needs to be mapped as a geopoint, yes.
little bit more help....how can i change the name??
The field does not need to have a specific name, but you need to specify the correct mapping for it e.g. through an index template.
Something like this should work for the location field:
PUT _template/logstash_template
{
"index_patterns": ["logstash_*"],
"settings": {
"number_of_shards": 1
},
"mappings": {
"doc": {
"properties": {
"location": {
"type": "geo_point"
}
}
}
}
}I tried doing the above method but still unable to accomplish the goal. After executing the above code it says:
{
"acknowledged" : true
}
but while using coordinates map again getting the same message.
You will need to create a new index in order for the template to apply.
But I remember the last time I created index for the same logs it was working absolutely fine. But when I created indices using pipeline.yml then this happened. eventually i can't use the IP range in visualization section
Shall I again create a new index with same name??
Make sure the new index name matches the pattern specified in the template.
Once I've created the index then I will run the above code....or shall I execute it first then create index?
First register the sample template I provided. It will then be applied once you create a new matching index, e.g. logstash_test. Then index into the index logstash_test in order to create it.
OK....I am just repeating what you said.....I will run the code
PUT _template/logstash_template
{
"index_patterns": ["logstash_test"],
"settings": {
}
}
then I will create index naming as "logstash_test".
You need the mappings part in the template.
PUT _template/logstash_template
{
"index_patterns": ["logstash_test"],
"settings": {
"number_of_shards": 1
},
"mappings": {
"doc": {
"properties": {
"location": {
"type": "geo_point"
}
}
}
}
}
can i change the number of shards???