# Converting a number for use in geo-point
**URL:** https://discuss.elastic.co/t/converting-a-number-for-use-in-geo-point/95252
**Category:** Logstash
**Created:** [July 31, 2017, 10:33pm UTC](https://discuss.elastic.co/t/converting-a-number-for-use-in-geo-point/95252 "2017-07-31T22:33:05Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@elaair](https://discuss.elastic.co/u/elaair)
#### Post date: [July 31, 2017, 10:33pm UTC](https://discuss.elastic.co/t/converting-a-number-for-use-in-geo-point/95252/1 "2017-07-31T22:33:05Z")
I have data that contains src\_latitude, src\_longitude, dst\_latitiude, and dst\_longitude. Some of the data is zero which seems to throw off elastic.
[2017-07-31T15:17:54,787][DEBUG][o.e.a.b.TransportShardBulkAction] [UzWEM4s] [netskope-31071411][0] failed to execute bulk item (index) BulkShardRequest [[netskope-31071411][0]] containing [988] requests
org.elasticsearch.index.mapper.MapperParsingException: failed to parse.
Caused by: java.lang.NumberFormatException: For input string: "%{src\_latitude}"
at sun.misc.FloatingDecimal.readJavaFormatString(FloatingDecimal.java:2043) ~[?:?]
at sun.misc.FloatingDecimal.parseDouble(FloatingDecimal.java:110) ~[?:?]
at java.lang.Double.parseDouble(Double.java:538) ~[?:1.8.0\_91]
at org.elasticsearch.common.geo.GeoPoint.resetFromString(GeoPoint.java:84) ~[elasticsearch-5.5.0.jar:5.5.0]
I am mapping the coordinate data to a float in the logstash config and in map template. I think this is working as the raw data is 0 and the data output by rubydebug is like this:"src\_latitude" =\> 0.0,
Does anyine know what is the cause of the elastic errors I am seeing?
logstash config
input {
```
file {
path => ["/Users/schroew/Documents/Scripts/NetskopeAPI/allNetSkopeEvents.json"]
type => "netSkopeAPI"
tags => "netSkopeAPI"
codec => "json"
}
```
} #close input
filter {
if [path] == "/Users/schroew/Documents/Scripts/NetskopeAPI/allNetSkopeEvents.json" {
```
split {
field => "data"
}
```
mutate {
rename =\> { "[data][dsthost]" =\> "dst\_host" }
rename =\> { "[data][dst\_region]" =\> "dst\_region" }
rename =\> { "[data][srcip]" =\> "srcip" }
rename =\> { "[data][fromlogs]" =\> "fromlogs" }
rename =\> { "[data][dstport]" =\> "dstport" }
rename =\> { "[data][src\_zipcode]" =\> "src\_zipcode" }
rename =\> { "[data][dstip]" =\> "dstip" }
rename =\> { "[data][suppression\_end\_time]" =\> "suppression\_end\_time" }
rename =\> { "[data][server\_bytes]" =\> "server\_bytes" }
rename =\> { "[data][src\_country]" =\> "src\_country" }
rename =\> { "[data][dst\_zipcode]" =\> "dst\_zipcode" }
rename =\> { "[data][dst\_longitude]" =\> "dst\_longitude" }
rename =\> { "[data][\_id]" =\> "id" }
rename =\> { "[data][numbytes]" =\> "numbytes" }
rename =\> { "[data][device]" =\> "device" }
rename =\> { "[data][\_insertion\_epoch\_timestamp]" =\> "insertion\_epoch\_timestamp" }
rename =\> { "[data][app\_session\_id]" =\> "app\_session\_id" }
rename =\> { "[data][access\_method]" =\> "access\_method" }
rename =\> { "[data][traffic\_type]" =\> "traffic\_type" }
rename =\> { "[data][src\_longitude]" =\> "src\_longitude" }
rename =\> { "[data][alert\_type]" =\> "alert\_type" }
rename =\> { "[data][resp\_cnt]" =\> "resp\_cnt" }
rename =\> { "[data][alert]" =\> "alert" }
rename =\> { "[data][browser]" =\> "browser" }
rename =\> { "[data][policy]" =\> "policy" }
rename =\> { "[data][dst\_latitude]" =\> "dst\_latitude" }
rename =\> { "[data][timestamp]" =\> "timestamp" }
rename =\> { "[data][dst\_country]" =\> "dst\_country" }
rename =\> { "[data][os]" =\> "os" }
rename =\> { "[data][org]" =\> "org" }
rename =\> { "[data][client\_bytes]" =\> "client\_bytes" }
rename =\> { "[data][src\_region]" =\> "src\_region" }
rename =\> { "[data][acked]" =\> "acked" }
rename =\> { "[data][src\_location]" =\> "src\_location" }
rename =\> { "[data][site]" =\> "site" }
rename =\> { "[data][dst\_location]" =\> "dst\_location" }
rename =\> { "[data][site]" =\> "site" }
rename =\> { "[data][dst\_location]" =\> "dst\_location" }
rename =\> { "[data][serial]" =\> "serial" }
rename =\> { "[data][src\_latitude]" =\> "src\_latitude" }
rename =\> { "[data][category]" =\> "category" }
rename =\> { "[data][user]" =\> "user" }
rename =\> { "[data][alert\_name]" =\> "alert\_name" }
rename =\> { "[data][activity]" =\> "activity" }
rename =\> { "[data][app\_activity]" =\> "app\_activity" }
rename =\> { "[data][dlp\_file]" =\> "dlp\_file" }
rename =\> { "[data][dlp\_incident\_id]" =\> "dlp\_incident\_id" }
rename =\> { "[data][dlp\_parent\_id]" =\> "dlp\_parent\_id" }
rename =\> { "[data][dlp\_profile]" =\> "dlp\_profile" }
rename =\> { "[data][dlp\_rule]" =\> "dlp\_rule" }
rename =\> { "[data][dlp\_rule\_count]" =\> "dlp\_rule\_count" }
rename =\> { "[data][dlp\_rule\_severity]" =\> "dlp\_rule\_severity" }
rename =\> { "[data][dst\_timezone]" =\> "dst\_timezone" }
rename =\> { "[data][file\_password\_protected]" =\> "file\_password\_protected" }
rename =\> { "[data][file\_lang]" =\> "file\_lang" }
rename =\> { "[data][file\_path]" =\> "file\_path" }
rename =\> { "[data][file\_size]" =\> "file\_size" }
rename =\> { "[data][file\_type]" =\> "file\_type" }
rename =\> { "[data][instance\_id]" =\> "instance\_id" }
rename =\> { "[data][managed\_app]" =\> "managed\_app" }
rename =\> { "[data][md5]" =\> "md5" }
rename =\> { "[data][mime\_type]" =\> "mime\_type" }
rename =\> { "[data][modified]" =\> "modified" }
rename =\> { "[data][object]" =\> "object" }
rename =\> { "[data][object\_id]" =\> "object\_id" }
rename =\> { "[data][object\_type]" =\> "object\_type" }
rename =\> { "[data][os\_version]" =\> "os\_version" }
rename =\> { "[data][owner]" =\> "owner" }
rename =\> { "[data][page\_id]" =\> "page\_id" }
rename =\> { "[data][scan\_type]" =\> "scan\_type" }
rename =\> { "[data][shared]" =\> "shared" }
rename =\> { "[data][src\_timezone]" =\> "src\_timezone" }
rename =\> { "[data][sv]" =\> "sv" }
rename =\> { "[data][transaction\_id]" =\> "transaction\_id" }
rename =\> { "[data][url]" =\> "url" }
rename =\> { "[data][userkey]" =\> "userkey" }
convert =\> {"insertion\_epoch\_timestamp" =\> "integer"}
convert =\> {"suppression\_end\_time" =\> "integer"}
convert =\> {"src\_latitude" =\> "float"}
convert =\> {"dst\_latitude" =\> "float"}
convert =\> {"src\_longitude" =\> "float"}
convert =\> {"dst\_longitude" =\> "float"}
} #Close mutate
mutate {
add\_field =\> { "src\_geo\_location" =\> "%{src\_latitude},%{src\_longitude}" }
add\_field =\> { "dst\_geo\_location" =\> "%{dst\_latitude},%{dst\_longitude}" }
remove\_field =\> ["%{data}"]
} #Close mutate
date { match =\> ["%{insertion\_epoch\_timestamp}", "UNIX"] }
date { match =\> ["%{suppression\_end\_time}", "UNIX"] }
```
} #close if
```
} # close filter
output {
stdout {codec =\> rubydebug}
elasticsearch {
hosts =\> ["127.0.0.1:9200"]
index =\> "netskope-31071411"
}
} #close output
My field map template
PUT \_template/netskopetemplate1
{
"template": "netskope-\*",
"mappings": {
"eventGeoLocations": {
"properties": {
"src\_geo\_location": {
"type": "geo\_point"
},
"dst\_geo\_location": {
"type": "geo\_point"
},
"src\_latitude": {
"type": "float"
},
"src\_longitude": {
"type": "float"
},
"dst\_latitude": {
"type": "float"
},
"dst\_longitude": {
"type": "float"
},
"insertion\_epoch\_timestamp": {
"type": "date"
}
}
}
}
}
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 31, 2017, 11:17pm UTC](https://discuss.elastic.co/t/converting-a-number-for-use-in-geo-point/95252/2 "2017-07-31T23:17:05Z")
> [@elaair](#):
>
> For input string: "%{src\_latitude}"
It's not populating the value correctly and simply passing through the variable.
---
### Author:  [@elaair](https://discuss.elastic.co/u/elaair)
#### Post date: [August 1, 2017, 12:11am UTC](https://discuss.elastic.co/t/converting-a-number-for-use-in-geo-point/95252/3 "2017-08-01T00:11:05Z")
True- and it totally confuses me. I create two new fields from the four original and the two popluate hand even have the correct data type.
add\_field =\> { "src\_geo\_location" =\> "%{src\_latitude},%{src\_longitude}" }
add\_field =\> { "dst\_geo\_location" =\> "%{dst\_latitude},%{dst\_longitude}" }
Pasted from Kibana-
dst\_geo\_location geo\_point
src\_geo\_location geo\_point
why would the syntax work in the add field but not elsewhere? Maybe I have some flaky data? Any ideas for trouble shooting? How can I tell from the rubydebug output if the value has been changed to a float?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 1, 2017, 12:12am UTC](https://discuss.elastic.co/t/converting-a-number-for-use-in-geo-point/95252/4 "2017-08-01T00:12:08Z")
Try adding a stdout to see what's happening, but likely the original `src_latitude` field is empty.
---
### Author:  [@elaair](https://discuss.elastic.co/u/elaair)
#### Post date: [August 1, 2017, 12:17am UTC](https://discuss.elastic.co/t/converting-a-number-for-use-in-geo-point/95252/5 "2017-08-01T00:17:04Z")
when I look in Kibana the map template and the convert is clearly not working.
Kibana-
dst\_latitude number
src\_latitude number
dst\_longitude number
src\_longitude number
Conf file-
convert =\> {"src\_latitude" =\> "float"}
convert =\> {"dst\_latitude" =\> "float"}
convert =\> {"src\_longitude" =\> "float"}
convert =\> {"dst\_longitude" =\> "float"}
---
### Author:  [@elaair](https://discuss.elastic.co/u/elaair)
#### Post date: [August 1, 2017, 12:22am UTC](https://discuss.elastic.co/t/converting-a-number-for-use-in-geo-point/95252/6 "2017-08-01T00:22:29Z")
That would make sense-
I had an if clause that was most likely wrong( since I have never done it before) I will revisit it.
if [src\_latitude] == "" {
mutate { replace =\> { "src\_latitude" =\> "0.0" } }
}
Do I need brackets or curly braces %{src\_latitude} ?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 1, 2017, 12:28am UTC](https://discuss.elastic.co/t/converting-a-number-for-use-in-geo-point/95252/7 "2017-08-01T00:28:45Z")
That's correct.
---
### Author:  [@elaair](https://discuss.elastic.co/u/elaair)
#### Post date: [August 1, 2017, 1:08am UTC](https://discuss.elastic.co/t/converting-a-number-for-use-in-geo-point/95252/8 "2017-08-01T01:08:55Z")
OK- Going with this. I will try and remove a 0.0 from a src\_latitude entry on my small and working data set and see what happens.
---
### Author:  [@elaair](https://discuss.elastic.co/u/elaair)
#### Post date: [August 1, 2017, 1:17am UTC](https://discuss.elastic.co/t/converting-a-number-for-use-in-geo-point/95252/9 "2017-08-01T01:17:20Z")
I don't think that null is the problem as I get parse errors on the json when I change the value to null.
---
### Author:  [@elaair](https://discuss.elastic.co/u/elaair)
#### Post date: [August 1, 2017, 4:08pm UTC](https://discuss.elastic.co/t/converting-a-number-for-use-in-geo-point/95252/10 "2017-08-01T16:08:37Z")
It was bad data from the source. The API guide did not specify the fields that would get returned for a particular query type. The src\_latitude ( among other fields) is missing in some of the data, hence the java error on trying to convert.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 29, 2017, 4:23pm UTC](https://discuss.elastic.co/t/converting-a-number-for-use-in-geo-point/95252/11 "2017-08-29T16:23:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.