# Add a field as a "parent" parameter with add\_field (for geo\_point)

**URL:** <https://discuss.elastic.co/t/add-a-field-as-a-parent-parameter-with-add-field-for-geo-point/55195>\
**Category:** Logstash\
**Created:** [July 11, 2016, 1:54pm UTC](https://discuss.elastic.co/t/add-a-field-as-a-parent-parameter-with-add-field-for-geo-point/55195 "2016-07-11T13:54:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![LouF](https://avatars.discourse-cdn.com/v4/letter/l/7ba0ec/32.png) [@LouF](https://discuss.elastic.co/u/LouF)\
**Post date:** [July 11, 2016, 1:54pm UTC](https://discuss.elastic.co/t/add-a-field-as-a-parent-parameter-with-add-field-for-geo-point/55195/1 "2016-07-11T13:54:39Z")

</div>

Hi,

I have a problem with the **geo\_point** type. I already applied a template on elasticsearch to transform the data i get into a **geo\_point**. This data is supposed to be the parameter **location**.  
I don't receive it from the log, that's why i want to add a new field named **location** by using the **add\_field** property.

I receive the logs in this format:  
`08-07-2016 14:10:22.039 country=Germany,lat=52,lon=12`

Thus, i would like to construct a parameter **Location** , parent of **lat** and **lon** to match my template.

My **filter** in logstash for this line looks like this:

```
 filter { 
     grok 
         ["message_loc", "%{LOG_DATE:log_date} %{GREEDYDATA:msg_location}"] 
     }
 }
 filter {
     kv {
         field_split => ","
         source => "msg_location"
     }
 }
 filter {
     mutate {
         convert => ["lat", "float"]
     }
     mutate {
         convert => ["lon", "float"]
     }
     mutate {
         add_field => {
             "[location][lat]" => "lat"
             "[location][lon]" => "lon" 
         }
     }
 }

```

I tried some solutions that come from this post:

> [@Add Geopoint based off of parsed value to logstash config](https://discuss.elastic.co/t/add-geopoint-based-off-of-parsed-value-to-logstash-config/26580/10):
>
> I am using elasticsearch 2.3.3 and logstash-2.3.1. What is the best way to create the geo\_point

First of all, i don't know if changing the type of **lat** and **lon** before is the right way to do it or not.

Then, the second problem is that the **add\_field** value seems to block the data. I'm also supposed to receive other logs through the same filter. However, no data are received in ES and Kibana at all.  
I made a test by removing this field and it seemed to work. But i need this field 😅  
If you have some ideas.

If you need more informations don't hesitate.  
Thank you for your attention.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 13, 2016, 4:44am UTC](https://discuss.elastic.co/t/add-a-field-as-a-parent-parameter-with-add-field-for-geo-point/55195/2 "2016-07-13T04:44:50Z")

</div>

> [@LouF](#):
>
> filter {  
> grok  
> ["message\_loc", "%{LOG\_DATE:log\_date} %{GREEDYDATA:msg\_location}"]  
> }  
> }  
> filter {  
> kv {  
> field\_split =\> ","  
> source =\> "msg\_location"  
> }  
> }

Have you run this on the data and seen the output using stdout with rubydebug? I don't think it does what you think it does.

---

<div class="post-metadata">

**Author:** ![LouF](https://avatars.discourse-cdn.com/v4/letter/l/7ba0ec/32.png) [@LouF](https://discuss.elastic.co/u/LouF)\
**Post date:** [July 13, 2016, 2:04pm UTC](https://discuss.elastic.co/t/add-a-field-as-a-parent-parameter-with-add-field-for-geo-point/55195/3 "2016-07-13T14:04:16Z")

</div>

Hi, thank you for your answer.

I just used stdout, and i replaced **message\_loc** by **message**.  
Also, **LOG\_DATE** is something i defined in my filter and i didn't mention in this topic.

After using the output stdout function i got these results:

```
{
            "message" => "13-07-2016 14:35:39.000 country=Germany,lat=52,lon=12",
           "@version" => "1",
         "@timestamp" => "2016-07-13T12:35:39.000Z",
         "input_type" => "log",
             "fields" => nil,
               "type" => "log",
              "count" => 1,
               "beat" => {
           "hostname" => "lls-geoloc-elk-gs-environment-compute-gsa-83ge8",
               "name" => "lls-geoloc-elk-gs-environment-compute-gsa-83ge8"
},
             "source" => "/tmp/geekshop.log",
             "offset" => 207856325,
               "host" => "louis-server-geoloc-elk-gs-environment-compute-gsa-83ge8",
               "tags" => [
            [0] "beats_input_codec_plain_applied"
        ],
           "log_date" => "13-07-2016 14:35:39.000",
            "country" => "Germany",
                "lat" => 52,
                "lon" => 12
           "location" => {
                "lat" => "lat",
                "lon" => "lon"
     }

}

```

Actually, it's what i expected.  
But i still don't get my **geolocation.lat** and **geolocation.lon** parameter in Kibana

This is my template for ES:

```
curl -XPUT localhost:9200/_template/template1 -d '
{
     "template": "logstash-*", 
     "settings": {
           "number_of_shards": 1 
     }, 
     "mappings": { 
           "log": { 
                  "properties" : { 
                         "location": { 
                                "type": "geo_point"
                          } 
                   } 
            } 
      }
}'
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:48am UTC](https://discuss.elastic.co/t/add-a-field-as-a-parent-parameter-with-add-field-for-geo-point/55195/4 "2017-07-06T04:48:13Z")

</div>