Elasticsearch mapping a value

Elastic Stack Elasticsearch
1

I'm trying to get Kibana to see my location info as a geo_point. I've been running about mapping and how to do it, but I can't seem to figure it out. The data looks like this in mongodb:

{ "_id" : "3", "loc" : "[-122.0574, 37.41919999999999]", "fs" : "Clean", "name" : "www.googleapis.com", "timestamp" : "2016-07-02T21:02:53.623Z", "destination" : "192.168.79.136", "source" : "216.58.212.138", "vt" : "0" }

How would I map the values that are stored in the key "loc" as geo_point?

2

https://www.elastic.co/guide/en/elasticsearch/reference/2.3/geo-point.html is what you want.

3

Hello Mark,

Thanks a bunch for your reply. I have tried getting the hang of that link before.. but I can't seem to figure out what I'm doing wrong.

Since my location is stored as a list/array, I'd assume I need this one, right?

PUT my_index/my_type/4
{
  "text": "Geo-point as an array",
  "location": [ -71.34, 41.12 ] 
}

So if you like to my mongodb record, I'd say mine would have to look like this:

PUT yapdns(index name)/loc(key where lon,lat are stored)/4(what does this 4 mean?)
{
  "loc": "Geo-point as an array",
  "location": [ -71.34, 41.12 ] 
}

why does "location": [ -71.34, 41.12 ] already has a value entered?

I also tried this:

curl -XPUT 'http://localhost:9200/yapdns/_mapping' -d '
    {
      "mappings": {
        "loc": {
          "properties": {
            "location": {
              "type": "geo_point"
            }
          }
        }
      }
    }
    }
'

but got this error:

{"error":{"root_cause":[{"type":"action_request_validation_exception","reason":"Validation Failed: 1: mapping type is missing;"}],"type":"action_request_validation_exception","reason":"Validation Failed: 1: mapping type is missing;"},"status":400}

Next I tried:

curl -XPUT 'http://localhost:9200/yapdns/_mapping/loc' -d '
{
  "properties": {
    "loc": {
      "type": "geo_point"
    }
  }
}

getting the following error on that:

{"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"mapper [loc] cannot be changed from type [string] to [geo_point]"}],"type":"illegal_argument_exception","reason":"mapper [loc] cannot be changed from type [string] to [geo_point]"},"status":400}

4

Any idea what I'm doing wrong here?

5

mapper [loc] cannot be changed from type [string] to [geo_point]

As it says, you can't change the mapping of a field. You have to reindex. If you haven't accrued any data in the index yet just delete it and recreate it.