# Geoip mapping is not working

**URL:** <https://forum.opensearch.org/t/geoip-mapping-is-not-working/13190>\
**Category:** OpenSearch Dashboards\
**Created:** [March 14, 2023, 7:06pm UTC](https://forum.opensearch.org/t/geoip-mapping-is-not-working/13190 "2023-03-14T19:06:57Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![beilei](https://avatars.discourse-cdn.com/v4/letter/b/779978/32.png) [@beilei](https://forum.opensearch.org/u/beilei)\
**Post date:** [March 14, 2023, 7:06pm UTC](https://forum.opensearch.org/t/geoip-mapping-is-not-working/13190/1 "2023-03-14T19:06:57Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):

opensearch:2.5.0  
opensearch-dashboards:2.5.0  
logstash-oss-with-opensearch-output-plugin:8.4.0

**Describe the issue** :

I used to have an attribute called geoip.location and it’s data type is geo\_point. I am using this geoip.location to map the geopoint in the Coordinate Map. It was working perfectly.

Suddenly somehow I found the geoip.location is gone. Instaed of geoip.location, I got geoip.geo.location.lat and geoip.geo.location.lon but I can’t use the Coordinate Map anymore.

Can someone help me? How can I get the geoip.location back or how can I get the Coordinate Map working?

**Relevant Logs or Screenshots** :

 ![Screenshot 2023-03-14 150501](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/9/9ce78ed47cd4b5d919355e21f7731b31d0169cb9.png)

---

<div class="post-metadata">

**Author:** ![joshuarrrr](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/joshuarrrr/32/4947_2.png) [@joshuarrrr](https://forum.opensearch.org/u/joshuarrrr)\
**Post date:** [March 28, 2023, 11:01pm UTC](https://forum.opensearch.org/t/geoip-mapping-is-not-working/13190/2 "2023-03-28T23:01:30Z")

</div>

@junqiu Do you have any insight here?

---

<div class="post-metadata">

**Author:** ![junqiu](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@junqiu](https://forum.opensearch.org/u/junqiu)\
**Post date:** [March 29, 2023, 4:18am UTC](https://forum.opensearch.org/t/geoip-mapping-is-not-working/13190/3 "2023-03-29T04:18:44Z")

</div>

The new format for your location data consists of two separate fields: `geoip.geo.location.lat` and `geoip.geo.location.lon` . This is different from the previous format you were using for `geo_point`, which had the entire location data stored in a single field called `geoip.location`.

Because we cannot update the mapping for an existing index, you can reindex your data with correct mapping.

Steps:

1. Create mapping for new destination index

```auto
PUT destination-index-name
{
  "mappings": {
      "properties": {
        "geoip": {
          "properties": {
            "geo": {
              "properties": {
                "location": {
                  "type": "geo_point"
                }
              }
            }
          }
        }
      }
  }
}

```

1. Reindex to copy all documents from existing index to destination index

```auto
POST _reindex
{
   "source":{
      "index":"existing-index-name"
   },
   "dest":{
      "index":"destination-index-name"
   }
}

```

Then you’ll have the geo\_point mapping for `geoip.geo.location` in the new index.

---

<div class="post-metadata">

**Author:** ![beilei](https://avatars.discourse-cdn.com/v4/letter/b/779978/32.png) [@beilei](https://forum.opensearch.org/u/beilei)\
**Post date:** [March 31, 2023, 2:51pm UTC](https://forum.opensearch.org/t/geoip-mapping-is-not-working/13190/4 "2023-03-31T14:51:59Z")

</div>

@junqiu

Thank you for your help.

my destination index name has _, like logstash-data-_. The \* stands for the date.

While I try to create a mapping for it, it shows " reason": “Invalid index name [logstash-data-\*], must not contain the following characters [, ", \*, \, \<, |, , \>, /, ?]”,"

Is there any way I can create a mapping for such index?

Thanks you  
Beilei

---

<div class="post-metadata">

**Author:** ![junqiu](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@junqiu](https://forum.opensearch.org/u/junqiu)\
**Post date:** [March 31, 2023, 4:40pm UTC](https://forum.opensearch.org/t/geoip-mapping-is-not-working/13190/5 "2023-03-31T16:40:15Z")

</div>

Hi @beilei

you can try to use an index template. An index template is a way to define settings and mappings for future indices that match a specified pattern. When you create an index that matches the template pattern, OpenSearch applies the template to the new index and uses the settings and mappings specified in the template.

> **[Index templates](https://opensearch.org/docs/latest/im-plugin/index-templates/)**
>
> Index templates

like:

```auto
PUT _index_template/logstash-data-template
{
  "index_patterns": [
    "logstash-data-*"
  ],
  "mappings": {
    "properties": {
      "geoip": {
        "properties": {
          "geo": {
            "properties": {
              "location": {
                "type": "geo_point"
              }
            }
          }
        }
      }
    }
  }
}

```