Dear All,
I split a list of data into different events. Here's the example data
data source
1.178.179.217
1.179.170.7
1.93.0.224
100.16.243.115
101.187.28.8
After split to different event, i put a template to change the field type of "BadIP" to "ip" as follow
{
"template_4": {
"order": 0,
"index_patterns": [
"test"
],
"settings": {},
"mappings": {
"doc": {
"properties": {
"BadIP": {
"type": "ip"
}
}
}
},
"aliases": {}
}
}
Then, I try to use geoip to map those ips as follow
filter{
if "feed" in [tags]{
split {field => "message"}
grok { match => {"message" => "%{IP:BadIP}"}}geoip{
source => "BadIP"
target => "BadIP.geoip"
add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}"]
add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"]
}
mutate{ convert => ["[geoip][coordinates]", "float"]}
}
}
However, it show following message. I don'y understand what is the meaning of "Existing mapping for [BadIP] must be of type object but found [ip]".
Any idea? Thanks
[2018-09-12T17:52:51,508][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"test", :_type=>"doc", :_routing=>nil},
#LogStash::Event:0x30c6b249], :response=>{"index"=>{"_index"=>"test", "_type"=>"doc", "_id"=>"8JMyzWUBA8S-QR9OfTd8", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"Could not
dynamically add mapping for field [BadIP.geoip]. Existing mapping for [BadIP] must be of type object but found [ip]."}}}}