ELK Stack - Customize autogenerated field mappings
<p>I've got a very basic ELK stack setup and passing logs to it via syslog. I have used inbuilt grok patterns to split the logs in to fields. But the field mappings are auto-generated by logstash elasticsearch plugin and I am unable to customize them.</p>

<p>For instance, I create a new field by name "dst-geoip" using logstash config file (see below):</p>

<pre><code>geoip {
  database =&gt; "/usr/local/share/GeoIP/GeoLiteCity.dat" ### Change me to location of GeoLiteCity.dat file
    source =&gt; "dst_ip"
    target =&gt; "dst_geoip"
    fields =&gt; [ "ip", "country_code2", "country_name", "latitude", "longitude","location" ]
    add_field =&gt; [ "coordinates", "%{[dst_geoip][latitude]},%{[geoip][longitude]}" ]
    add_field =&gt; [ "dst_country", "%{[dst_geoip][country_code2]}"]
    add_field =&gt; [ "flow_dir", "outbound" ]
}
</code></pre>

<p>I want to assign it the type "geo_point" which I cannot edit from Kibana. Online documents mentions manually updating the mapping on respective index using ElasticSearch APIs. But Logstash generates many indices (one per day). If I update one index, will the mapping stay the same in future indices?</p>