The thing is that I haven't understood yet how to convert them with "geoip", function and mutate.
The geoip filter turns IP addresses into lat/lon values, but you already have the lat/lon values so you don't need that filter. All you need to do is
- store the lat/lon values in a field so that it can be recognized as geo_point (see Geopoint field type | Elasticsearch Guide [8.11] | Elastic),
- map that field as geo_point in ES, possibly by using an index template.
If I've understood what you said, I have to rename the index something like: "logstash-positions_gps".
If you want to rely on Logstash's index template, yes. The template maps the [geoip][location]
field as geo_point.
So to summarize, name your index logstash-positions_gps och store the lat/lon values in [geoip][location]
in a format described in the docs I linked to above. If you want to customize the index name or the field name then that's fine, but I suggest you get it working first.