Why does logstash not mark [geoip][location] as "geo_point"?

Hi. I use logstash to analyze web requests. To build a map of query, I use the geoIP module.
When using this module I found a small error :nerd_face:
The documentation says:


In practice, the data received does not have an any type:

To solve this problem, i need to use custom mapping.

Why is this field incorrectly mapped in elastic?

Logstash and Filebeat typically creates index templates that matches indices with the standard names containing the custom mapping required for this. As your index has a custom name, these index templates does not apply and dynamic mapping instead takes place, which (correctly) identifies these two fields as float fields.

This is why you need to add a custom index template for your index.

What a surprise))) Interesting.
Thank you!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.