Concatenate 2 values to make a geo_point field

[Ragnar (Gil Felot)]

I have an index where from an ip field from the data source I have added the filter geoip to logstash that get the data. I got in my index a brand new bunch of field about latitude, longitude, city... but it's not usable as it is to pinpoint on a map since the long/lat are of type string or number.

I added to the mapping of this index a new field of type geo_point and I would like now to fill it with the concatenation of "lon"+","+"lat" like the seconde exemple here.

Can I do that easily ?

[ftr]

Don't know if it counts as "easy", but you can iterate a script over the documents in your index. Assume that you have the index "locations" with the latitude in the "lat" field and the longitude in the "lon" field and the file "script" contains the following line:

{"script" : {"source" : "ctx._source[\"loc\"] = [ctx._source[\"lat\"],ctx._source[\"lon\"]]", "lang" : "painless" } }

Then the linux command

curl -XPOST 'http://localhost:9200/locations/_doc/1/_update' -H 'content-type:application/json' -d@script

will update the document with _id = 1 so that the (geo_point) field "loc" contains the location.

NB: The above curl line assumes that you are using ES 6.x (or earlier). For ES 7.x, drop the "_doc" part of the path for curl, since elasticsearch finally dropped the idea of types...