Does logstash map to geo_point type when parsing geoip?

input{
  kafka{
    codec => "json"
    decorate_events => true
    ......
    }
}


filter {
    geoip {
       source => "remote_addr"
       target => "geoip"
       add_field => ["[geoip][coordinates]","%{[geoip][longitude]}"]
       add_field => ["[geoip][coordinates]","%{[geoip][latitude]}"]
    }
    mutate {
      convert => {
        "[geoip][coordinates]" => "float"
      }
    }
}

output {
   elasticsearch {
       hosts => ["192.168.10.139:9200","192.168.10.140:9200","192.168.10.141:9200"]
       index => "nginx"
    }
   }
}

I saw someone mentioned a long time ago, is there any way to make the custom index use the default logstash template?

Take the default template, update the value of index_patterns to match your custom index name, and PUT it into elasticsearch.

Solved the problem, thank you

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.