# Unable to visualize data on map

**URL:** https://discuss.elastic.co/t/unable-to-visualize-data-on-map/44823
**Category:** Kibana
**Created:** [March 18, 2016, 9:43am UTC](https://discuss.elastic.co/t/unable-to-visualize-data-on-map/44823 "2016-03-18T09:43:16Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![garanews](https://avatars.discourse-cdn.com/v4/letter/g/3d9bf3/32.png) [@garanews](https://discuss.elastic.co/u/garanews)
#### Post date: [March 18, 2016, 9:43am UTC](https://discuss.elastic.co/t/unable-to-visualize-data-on-map/44823/1 "2016-03-18T09:43:16Z")

</div>

Hello,  
just installed last version of ELK and have issue visualizing geo data on map.  
My logstash.conf:

```
                            geoip {
                                    source => "src_ip"
                                    target => "src_ip_geoip"
                                    database =>"/usr/share/GeoIP/GeoLiteCity.dat"
                                    add_field => ["[src_ip_geoip][coordinates]", "%{[src_ip_geoip][longitude]}" ]
                                    add_field => ["[src_ip_geoip][coordinates]", "%{[src_ip_geoip][latitude]}" ]
                                    }
                            geoip {
                                    source => "src_ip"
                                    target => "src_ip_geoip"
                                    database =>"/usr/share/GeoIP/GeoIPASNum.dat"
                                     }
                            geoip {
                                    source => "dst_ip"
                                    target => "dst_ip_geoip"
                                    database =>"/usr/share/GeoIP/GeoLiteCity.dat"
                                    add_field => ["[dst_ip_geoip][coordinates]", "%{[dst_ip_geoip][longitude]}" ]
                                    add_field => ["[dst_ip_geoip][coordinates]", "%{[dst_ip_geoip][latitude]}" ]
                                     }
                            geoip {
                                    source => "dst_ip"
                                    target => "dst_ip_geoip"
                                    database =>"/usr/share/GeoIP/GeoIPASNum.dat"
                                     }
            mutate {
                                            convert => ["[src_ip_geoip][coordinates]", "float" ]
                                            convert => ["[dst_ip_geoip][coordinates]", "float" ]
                    }

```

output {  
elasticsearch {  
hosts =\> ["127.0.0.1:9200"]  
sniffing =\> false  
manage\_template =\> false  
}  
}

the elasticsearch template:

curl -XGET '[http://127.0.0.1:9200/\_template/filebeat?pretty](http://127.0.0.1:9200/_template/filebeat?pretty)'  
{  
"filebeat" : {  
"order" : 0,  
"template" : "filebeat-_",  
"settings" : {  
"index" : {  
"refresh\_interval" : "5s"  
}  
},  
"mappings" : {  
"default" : {  
"dynamic\_templates" : [ {  
"template1" : {  
"mapping" : {  
"ignore\_above" : 1024,  
"index" : "not\_analyzed",  
"type" : "{dynamic\_type}",  
"doc\_values" : true  
},  
"match" : "_"  
}  
} ],  
"\_all" : {  
"norms" : {  
"enabled" : false  
},  
"enabled" : true  
},  
"properties" : {  
"dst\_ip\_geoip" : {  
"dynamic" : true,  
"type" : "object",  
"properties" : {  
"location" : {  
"type" : "geo\_point"  
}  
}  
},  
"@timestamp" : {  
"type" : "date"  
},  
"offset" : {  
"type" : "long",  
"doc\_values" : "true"  
},  
"src\_ip\_geoip" : {  
"dynamic" : true,  
"type" : "object",  
"properties" : {  
"location" : {  
"type" : "geo\_point"  
}  
}  
},  
"message" : {  
"index" : "analyzed",  
"type" : "string"  
}  
}  
}  
},  
"aliases" : { }  
}  
}

In Kibana I see the data, like  
dst\_ip\_geoip.location 13.133300000000008, 31.23330000000001  
but are not shown on map.  
Under settings -\> indices i have that fileld as string type and not geo\_point and don't know how to change.

Do you have any idea?  
Many thanks in advance.

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 19, 2016, 11:50pm UTC](https://discuss.elastic.co/t/unable-to-visualize-data-on-map/44823/2 "2016-03-19T23:50:50Z")

</div>

> [@garanews](#):
>
> Under settings -\> indices i have that fileld as string type and not geo\_point and don't know how to change.

You need a template in place that defines this before you send the data to ES.  
Thus you cannot change it, you need to reindex the data.

---

<div class="post-metadata">

### Author: ![garanews](https://avatars.discourse-cdn.com/v4/letter/g/3d9bf3/32.png) [@garanews](https://discuss.elastic.co/u/garanews)
#### Post date: [March 20, 2016, 8:08am UTC](https://discuss.elastic.co/t/unable-to-visualize-data-on-map/44823/3 "2016-03-20T08:08:47Z")

</div>

Can you please suggest me how to do it?

Il 20.03.2016 01:01 Mark  
Walkom ha scritto:

> warkolm [1] Mark Walkom [2]  
> March 19

garanews:

> > Under settings -\> indices i have that fileld as string  
> > type and not geo\_point and don't know how to change.
> 
> You need a  
> template in place that defines this before you send the data to ES.

Thus you cannot change it, you need to reindex the data.

> Visit Topic [3] or reply to this email to  
> respond
> 
> To stop receiving notifications for this particular topic,  
> click here [4]. To unsubscribe from these emails, change your user  
> preferences [5]

Connetti gratis il mondo con la nuova indoona: hai la chat, le chiamate, le video chiamate e persino le chiamate di gruppo.  
E chiami gratis anche i numeri fissi e mobili nel mondo!  
Scarica subito l’app Vai su [https://www.indoona.com/](https://www.indoona.com/)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:58pm UTC](https://discuss.elastic.co/t/unable-to-visualize-data-on-map/44823/4 "2017-07-06T13:58:31Z")

</div>


