Does logstash map to geo_point type when parsing geoip?

Elastic Stack Logstash
1 
input{
  kafka{
    codec => "json"
    decorate_events => true
    ......
    }
}


filter {
    geoip {
       source => "remote_addr"
       target => "geoip"
       add_field => ["[geoip][coordinates]","%{[geoip][longitude]}"]
       add_field => ["[geoip][coordinates]","%{[geoip][latitude]}"]
    }
    mutate {
      convert => {
        "[geoip][coordinates]" => "float"
      }
    }
}

output {
   elasticsearch {
       hosts => ["192.168.10.139:9200","192.168.10.140:9200","192.168.10.141:9200"]
       index => "nginx"
    }
   }
}

I saw someone mentioned a long time ago, is there any way to make the custom index use the default logstash template?

2

Take the default template, update the value of index_patterns to match your custom index name, and PUT it into elasticsearch.

3

Solved the problem, thank you

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.