kibana geo_point How to Part 3

Now check again....


1、template_filebeat.json

Can only

{
  "index_patterns": ["filebeat*"],
  "settings": {
    "number_of_shards": 1
  },
  "mappings": {
  "doc": {
   "properties": {
    "geoip.location": {
     "type": "geo_point"
        },
    "geoip.coordinates": {
     "type": "geo_point"
        }
   }
  }
 }
  
}

Here Import： "location" is Error, Must "geoip.location"

But sometime why no use, because my way insert index-pattern, so geoip.location no field, always is
geoip.location.lat  and geoip.location.lon overwrtie.

see 2.

2、index-pattern  index-pattern-export.json

one way just try to put

{\"name\":\"geoip.location\",\"type\":\"geo_point\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true}

and remove geoip.location.lat  and geoip.location.lon .


When put template, index in kibana index Patterns delete is NO Use. Must delete in Dev Tools

DELETE filebeat-6.4.2-2018.11.19

GET _cat/indices?v
GET _cat/indices?v&s=index

check exist or not. Then import data again, index recreate, then apply template.