# Unsupported symbol \[-\] in geohash

**URL:** <https://discuss.elastic.co/t/unsupported-symbol-in-geohash/268563>\
**Category:** Logstash\
**Created:** [March 27, 2021, 6:02pm UTC](https://discuss.elastic.co/t/unsupported-symbol-in-geohash/268563 "2021-03-27T18:02:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Post date:** [March 27, 2021, 6:02pm UTC](https://discuss.elastic.co/t/unsupported-symbol-in-geohash/268563/1 "2021-03-27T18:02:45Z")

</div>

I am facing some issue while defining mapping for an index

```auto
[2021-03-27T23:27:36,733][WARN][logstash.outputs.elasticsearch][packetbeat][7bb6e349f13f74fc053ef83bdac5d84b4de038193ed7d008068e4432f88bd27d] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"log-pb-flow-2021.03.27", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0x1b2d34b5>], :response=>{"index"=>{"_index"=>"log-pb-flow-2021.03.27", "_type"=>"_doc", "_id"=>"XzTVdHgBRP-3kKikkO1x", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [destination.location] of type [geo_point]", "caused_by"=>{"type"=>"parse_exception", "reason"=>"unsupported symbol [-] in geohash [-93.6112]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"unsupported symbol [-] in geohash [-93.6112]"}}}}}}

```

logstash pipeline file

```auto
input {
  beats {
    port => 5044
  }
}

filter {
  if [agent][type]=="packetbeat" {
        geoip {
        add_tag => ["GeoIP"]
        source => "[destination][ip]"
        add_field => ["[destination][location]", "%{[geoip][longitude]}" ]
        add_field => ["[destination][location]", "%{[geoip][latitude]}" ]
        #database => "/usr/share/logstash/GeoLite2-City.mmdb"
 }
}
}
output
{
if [agent][type]=="packetbeat" {
if[type]=="flow"
   {
    elasticsearch {
    hosts => "localhost:9200"
    manage_template => false
    index => "log-pb-flow-%{+YYYY.MM.dd}"
  }
  }
}
}

```

My index template

```auto
PUT /_template/packetbeat_flow
{
  "index_patterns": ["log-pb-flow-*"],
  "settings": {
    "number_of_replicas": 0
  },
  "mappings" : {
 "properties": {
      "client.ip":{"type": "ip",
        "fields": {
         "keyword":{"type":"keyword"}
       }
      },
      "host.ip":{"type": "ip",
        "fields": {
         "keyword":{"type":"keyword"}
       }
      },
      "server.ip":{"type": "ip",
      "fields": {
         "keyword":{"type":"keyword"}
       }},
      "source.ip":{"type": "ip",
       "fields": {
         "keyword":{"type":"keyword"}
       }
      },
"destination.ip" : { "type": "ip"
},
"destination.location" : {"type": "geo_point"},
"geoip" : {
  "dynamic": true,
"properties" : 
{
"ip":{"type":"ip"},
          "latitude":{"type":"half_float",
          "fields":{
              "lat":{"type":"half_float"}
            
          }
          },
          "longitude":{"type":"half_float",
               "fields":{
              "lat":{"type":"half_float"}
            
          }
            },
          "location":{"type":"geo_point"}
}
}
}  
}
}

```

i dont know where i am doing wrong

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 27, 2021, 6:27pm UTC](https://discuss.elastic.co/t/unsupported-symbol-in-geohash/268563/2 "2021-03-27T18:27:15Z")

</div>

> [@Aniket\_Pant](#):
>
> ```auto
> add_field => ["[destination][location]", "%{[geoip][longitude]}" ]
> add_field => ["[destination][location]", "%{[geoip][latitude]}" ]
> 
> ```

Did you mean

```
add_field => {
    "[destination][location][lon]" => "%{[geoip][longitude]}"
    "[destination][location][lat]" => "%{[geoip][latitude]}"
}

```

My guess is that the error message indicates elasticsearch is trying to interpret -93.6112 as a latitude, which cannot be negative.

---

<div class="post-metadata">

**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Post date:** [March 28, 2021, 3:06am UTC](https://discuss.elastic.co/t/unsupported-symbol-in-geohash/268563/3 "2021-03-28T03:06:57Z")

</div>

```auto
""}}}}}}
[2021-03-28T08:34:18,825][WARN][logstash.outputs.elasticsearch][packetbeat][d43bdd2a9866aef5e63d1cc59ff1045af8b205b2c9c4fb1919aec905c59aa659] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"log-pb-flow-2021.03.28", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0x7844ad5e>], :response=>{"index"=>{"_index"=>"log-pb-flow-2021.03.28", "_type"=>"_doc", "_id"=>"dzfKdngBRP-3kKikFUtZ", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [destination.location] of type [geo_point]", "caused_by"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [destination.location.lon] of type [half_float] in document with id 'dzfKdngBRP-3kKikFUtZ'. Preview of field's value: 'null'", "caused_by"=>{"type"=>"number_format_exception", "reason"=>"For input string: \"9ydqy025w0qn\""}}}}}}

```

i made the changes in pipeline file

```auto
filter {
  if [agent][type]=="packetbeat" {
        geoip {
        add_tag => ["GeoIP"]
        source => "[destination][ip]"
        add_field => ["[destination][location][lon]", "%{[geoip][longitude]}" ]
        add_field => ["[destination][location][lat]", "%{[geoip][latitude]}" ]
        database => "/usr/share/logstash/GeoLite2-City.mmdb"
 }
}
}

```

and in template too

```auto
"destination":
{
  "dynamic":true,
  "properties": {
    "ip":{"type":"ip"},
    "location":{"type":"geo_point",
      "fields":{"lat":{"type":"half_float"},
        "lon":{"type":"half_float"}
      }
    }
    
  }
},
"geoip" : {
  "dynamic": true,
"properties" : 
{
"ip":{"type":"ip"},
          "latitude":{"type":"half_float",
          "fields":{
              "lat":{"type":"half_float"}
            
          }
          },
          "longitude":{"type":"half_float",
               "fields":{
              "lat":{"type":"half_float"}
            
          }
            },
          "location":{"type":"geo_point"}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 25, 2021, 3:07am UTC](https://discuss.elastic.co/t/unsupported-symbol-in-geohash/268563/4 "2021-04-25T03:07:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.