Create geo_points using script fields

[AstroSlazak]

Hi,

I'm working on problem where i get a message:
"DateTime:22.10.2019 10.24.15,Longitude:10,3315497,Latitude:63,3504556,Bearing:0" and trying to get location from it and show it on map. But now i have a problem, i am able to get the longitude and the latitude but i dont know how to show them on map. Anyone has any idea ?

This is my script

String s = doc['message.keyword'].value.replace(",",".");
def lon = /(?<=Longitude:)(.)(?=.Latitude:)/.matcher(s);
def lat = /(?<=.Latitude:)(.)(?=.Bearing:)/.matcher(s);
if (lon.find()) {

return lon.group()
}

[bhavyarm]

Hello,

You need to ingest geoip data to make this work. This should help:

Kibana not visualizing geoip in coordinate map

Hi, I'm having trouble visualizing my sysmon DNS logs with GeoIP resolved location on coordinate map in kibana. Following info is being added by geoip to each log entry: [logs_fields] so it looks like longtitude and latitude is added, but so called destination_geo.location itself isn't there. index mapping contains following: "destination" : { "properties" : { "address" : { "type" : "keyword", "ignore_above" : 1024 }, "bytes" : { …

Thanks,
Bhavya

[wylie (Wylie Conlon)]

Right, geo fields can't be used dynamically via scripted fields. They need to be available in the mapping of the index.

[AstroSlazak]

OK i created a geo_point - HFPSlocation and now i want to input extracted data from messeage to it , but i got nothing

DELETE _ingest/pipeline/HFPSLocation
PUT _ingest/pipeline/HFPSLocation
{
"description": "use index:rti-logstash",
"processors": [
{
 "script": {
   "source": """if (ctx.message.size() !== 0){
     if (ctx.service.name == "HFPS") {
         String s = ctx.message.replace(",",".");
         def lon = /(?<=Longitude:)(.*)(?=.Latitude:)/.matcher(s);
         def lat = /(?<=.Latitude:)(.*)(?=.Bearing:)/.matcher(s);
       if (lon.find() & lat.find()){
         ctx.HFPSLongitude = lon.group();
         ctx.HFPSLatitude = lat.group();
       }}}"""
  }
 }
 ,{ "set": {
  "field": "HFPSlocation",
  "value": "{{ctx.HFPSLatitude}},{{ctx.HFPSLatitude}}"
 }
 }
]
}