logstash geoip.location mapping to geo_point not working
You probably just have a typo (point 1), but including several other things to note.
- You are using
geoip.coordinatesin logstash andgeoip.locationin your_mapping - You need to remove the
convert => [ "[geoip][coordinates]", "float"]- that's wrong. - Once there is data in a field in ES, you can't convert it to a
geo_pointwithout re-indexing your data with a new mapping (if you are in a development stage, that usually means delete any indexes and re-insert your data). - After any mapping change, there is a button in kibana settings to reload your mapping.
https://discuss.elastic.co/t/geoip-location-not-getting-mapped-to-a-geo-point-type/78625
Issue was my ignorance of how index mapping works. This default mapping is being applied to indices matching the name "logstash-*" and my index name did not match that.
Changing my index name to logstash-myindex worked.