Elasticsearch不存储Logstash的Geoip数据

Question

I'm trying to add the geoip map to kibana, following the into to logshash I can see the correct output from the rubydebug codec:

"geoip" => {
    "location" => [
        [0] -122.3426,
        [1] 47.739599999999996
    ],

But when I query elasticsearch (using the query from kibana) for anything with a "geoip.location" field I get all the results. And none of the results have a geoip field.

{
"query": {
    "filtered": {
        "query": {
            "bool": {
                "should": [
                    {
                        "query_string": {
                            "query": "*"
                        }
                    }
                ]
            }
        },
        "filter": {
            "bool": {
                "must": [
                    {
                        "range": {
                            "@timestamp": {
                                "from": 1409025267221,
                                "to": 1409111667222
                            }
                        }
                    },
                    {
                        "exists": {
                            "field": "geoip.location"
                        }
                    }
                ]
            }
        }
    }
},
"fields": [
    "geoip.location",
    "_id"
],
"size": 1000,
"sort": [
    {
        "@timestamp": {
            "order": "desc"
        }
    }
]
}

Answer 1

Nevermind, it was that the dates were out of range. When I added some recent data they showed up on the map