To Add Geocoordinates to an index, use
curl -XPUT http://localhost:9200/syslog-2015.05.18 -d '
{
"mappings" : {
"log" : {
"properties" : {
"geo" : {
"properties" : {
"coordinates" : {
"type" : "geo_point"
}
}
}
}
}
}
}
';
Of cause, the "syslog-2015.05.18" is variable from installation to installation, I do put Apache logs into the filebeat index.
With ELK 5 Stack (Logstash 5.X), Geo coordinates uses the GeoLite2 database, not version 1 - find v2 at http://dev.maxmind.com/geoip/geoip2/geolite2/
When You have data in with Geo-coordinates, refresh index fields:
