We have an existing elastic stack that's been running fine for a while. Recently I went to create a new map visualization and found that Kibana does not recognize any of our indices as having valid geopoint data. The logstash pipeline uses the geoip plugin, which created a geop.location field that was compatible with the older map visualizations. I'd heard that the new visualization works differently, but I'm not sure why our existing data does not seem to work. In our mapping file, we even specify that the location is geopoint:
"properties": {
"@apache_timestamp": {
"type": "date"
},
"geoip": {
"dynamic": true,
"properties": {
"ip": {
"type": "ip"
},
"location": {
"type": "geo_point"
},
"latitude": {
"type": "half_float"
},
"longitude": {
"type": "half_float"
}
}
}
}
Just sampling some of the data, I can see that geoip.location looks like a geopoint (with a lat and lon) at least as far as I can tell.
Has anyone else run into this?
Elastic stack is 7.7.0. I know that maps used to work fine when we were running 6.x, so I'm guessing that something happened when it was upgraded, I just don't know what, or how to fix it.
question from:https://stackoverflow.com/questions/65852009/kibana-is-not-recognizing-geopoint-data
