mutate {
add_field => {"geoip.location" => ["%{longitude}","%{latitude}"]}
convert => { "geoip.location" => "float" }
}
I'm not sure if these directives are necessarily processed in order. I'd try splitting this in two mutate filters (one with add_field
and one with convert
) just to make sure the field is added before we attempt to convert its type.