ES is rejecting my geo_point object

Elastic Stack Elasticsearch
1

Hello,
I am having some trouble understanding why my geo_point object is being rejected by ES.
I am using serilog (with the elasticsearch sink) to feed data into elasticsearch and kibana to display the results.

If i have a new ES index, and i set the following template (this is the only change from default that i do)

PUT _template/template_geopointtest
{
  "index_patterns": [
    "logstash*"
  ],
  "mappings": {
    "logevent": {
      "properties": {
        "fields": {
          "properties": {
            "location": {
              "type": "geo_point"
            }
          }
        }
      }
    }
  }
}

To send the geo_point to ES, I use this line
Log.Information("{name}{@location}{@value}{property}", name, 2000, "Temperature");

Because the above line has the @ symbol in front of the word "location", the location object will be deconstructed into a JSON object and sent to ES in that format.
e.g. like this (sorry about the formatting, the editor doesn't seem to be recognizing it as formatted text)
{
"_index": "logstash-2019.03.01",
"_type": "logevent",
"_id": "eOOLN2kBosvpV7qDsM5l",
"_version": 1,
"_score": null,
"_source": {
"@timestamp": "2019-03-01T15:38:16.4592112+11:00",
"level": "Information",
"messageTemplate": "{name}{@location}{@value}{property}",
"message": ""MyDesk"Location { lat: 34.7797508239746, lon: 32.927131652832 } 594"Temperature"",
"fields": {
"modulename": "MyDesk",
"location": {
"_typeTag": "Location",
"lat": 34.77975082397461,
"lon": 32.92713165283203
},
"value": 594,
"property": "Temperature"
}
},
"fields": {
"@timestamp": [
"2019-03-01T04:38:16.459Z"
]
},
"sort": [
1551415096459
]
}

BUT i get the following error

Failed to store event with template '{name}{@location}{@value}{property}' into Elasticsearch. Elasticsearch reports for index logstash-2019.03.01 the following: {"type":"mapper_parsing_exception","reason":"failed to parse","caused_by":{"type":"parse_exception","reason":"field must be either [lat], [lon] or [geohash]"}}

Am i getting this error because of the "_typeTag" element that exists in the location object?
If so, any i dea on how i may remove the element from the sending side or modify the receiving side to accept the object?
Thanks for your help
Cheers
Stuart

2

That's probably the problem, can you remove it?

3

Thanks for answering. I have (just now) found a way to remove that tag and elasticsearch now picks up my location correctly
:slight_smile:

4

Oh, and the way i removed that element was in the initialisation of serilog, i put in this line
.Destructure.ByTransforming<Location>(r => new{ lat=r.lat,lon=r.lon})

which basically says, when serilog pulls apart the location object, only include the lat and lon elements in the resulting json

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.