My logstash config:
filter {
grok {
match => {"stack_trace" => "%{JAVACLASS:exception_class}: \[%{DATA:error_level}\]\[%{BASE10NUM:error_code}\]-%{GREEDYDATA:error_message}"}
}
grok {
match => {"message" => "%{DATA:geo_message}: carrier=%{DATA:carrier}, province=%{DATA:province}, city=%{DATA:city}, location=%{BASE10NUM:latitude},%{BASE10NUM:longitude}"}
add_tag => ["geo_parse_succeed"]
}
if "geo_parse_succeed" in [tags] {
mutate {
add_field => {"geoip.location" => ["%{longitude}","%{latitude}"]}
convert => { "geoip.location" => "float" }
}
}
}
And the log:
"_source": {
"@timestamp": "2015-10-15T11:14:40.547+08:00",
"@version": 1,
"message": "New crawl task: carrier=CARRIER, province=provY, city=cityX, location=45.7656666,126.6160584",
"level": "INFO",
"level_value": 20000,
"carrier": "CARRIER",
"remoteIp": "127.0.0.1",
"province": "provY",
"tid": "40562a0a-558f-4a4a-b664-b5ef1a3cd565",
"service": "crawler",
"host": "192.168.5.130:56020",
"type": "redis-input",
"tags": [
"_grokparsefailure",
"geo_parse_succeed"
],
"geo_message": "New crawl task",
"city": "cityX",
"latitude": "45.7656666",
"longitude": "126.6160584",
"geoip.location": [
"126.6160584",
"45.7656666"
]
},
As you see, the element of geoip.location
is still string(not float), but I don't see any error log from logstash..