Winlogbeat-* index has geoip.location as number
Using the guide https://www.elastic.co/blog/monitoring-windows-logons-with-winlogbeat
geoip.location was empty when examining event logs 4624.
After following the instructions in the guide geoip.location was populated with information, but geo_point was not referenced to geoip.location
filebeat-* index has geoip.location as geo_point but the map will not displat any geo_points - just a map with a red dot.
Used the guide https://www.elastic.co/blog/geoip-in-the-elastic-stack to setup filebeat.