Add geo point in Elastic

Elastic Stack Logstash
1

Hi everyone,
I use ELK and filebeat. I send a lot of logs with different fields.
logstash config:

input {
    beats {
      port => 5044
      include_codec_tag => false
    }
}

filter {
  if [type] == "json" {
    json {
      source => "message"
      target => "msg"
    }
    mutate {
      remove_field => ["msg.ecs.version", "ecs.version", "@version"]
    }
  }
  if [type] != "json" {
    grok {
      match => {
        message => ["time=\"%{TIMESTAMP_ISO8601:time}\""]
        }
      }
    date {
      match => [ "time", "YYYY-MM-dd'T'HH:mm:ssZZ"]
      target => "time"
    }
  }
}

output {
  elasticsearch {
    hosts => ["elasticsearch:9200"]
    sniffing => true
    manage_template => false
    index => "%{[source][project]}-%{[source][application]}-%{+YYYY.MM.dd}"
  }
}

Some of my message contain location

{
"location": {
    "lat": 11.11,
    "lon": 22.22
  }
}

In elastic I can see my location, ( msg.location.lat and msg.location.lon ), but I don't know how convert my location to geo_point. As I understand current index mapping is created by logstash plugin or by elastic search by default template. What and where shoud I write to use my location as geo_point?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.