Facing Issue in converting geoip.location to geo_point datatype

Elastic Stack Elasticsearch
1

Hi Community Members,

I have tried to generate the visualization using coordinate maps in kibana from nginx server logs which is streamed in elasticsearch storage, since i failed in type casting geo_point datatype properly for geoip.location field i was not able to generate reports.

After researching on web, I have configured my logstach filter plugin like below, but it haven't worked out properly

LoGSTACH CONFIG FILE:

input {
  beats {
    port => 5044
  }

}

filter {

if [fileset][name] == "access" {
grok {
match => [ "message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra_fields}"]
overwrite => [ "message" ]
}

  
geoip {
source => "clientip"
target => "geoip"
add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
add_tag => [ "nginx-geoip" ]
}

mutate {
    convert => ["response", "integer"]
    convert => ["bytes", "integer"]
    convert => ["responsetime", "float"]
    convert => [ "[geoip][coordinates]", "float"]
    }

date {
match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
remove_field => [ "timestamp" ]
}



useragent {
      source => "user_agent"    
}
}

else if [fileset][name] == "error" {
grok {
match => [ "message" , "(?<timestamp>%{YEAR}[./-]%{MONTHNUM}[./-]%{MONTHDAY}[- ]%{TIME}) \[%{LOGLEVEL:severity}\] %{POSINT:pid}#%{NUMBER}: %{GREEDYDATA:errormessage}(?:, client: (?<client>%{IP}|%{HOSTNAME}))(?:, server: %{IPORHOST:server})(?:, request: %{QS:request})?(?:, upstream: \"%{URI:upstream}\")?(?:, host: %{QS:host})?(?:, referrer: \"%{URI:referrer}\")"]
overwrite => [ "message" ]
}
 

geoip {
source => "client"
target => "geoip"
add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
add_tag => [ "nginx-geoip" ]
}
 
mutate {
    convert => [ "[geoip][coordinates]", "float"]
   }

date {
match => [ "timestamp" , "YYYY/MM/dd HH:mm:ss" ]
remove_field => [ "timestamp" ]
}
}

output {
if [fileset][name] == "access" {
elasticsearch {
		hosts => "elasticsearch:9200"          
		index => "nginx-access"       
	}
}
else if [fileset][name] == "error" {
elasticsearch {
		hosts => "elasticsearch:9200"          
		index => "nginx-error"       
	}
}
}

Any Help will be greatly appreciated...

Thank You!

2 
mutate {
                add_field => {
                "MLGeo" => "%{[geoip][latitude]}, %{[geoip][longitude]}"
                    }
                     }

I dont think you have to convert the type to float

3

Tried the above mentioned changes, still I am getting "No Compatible Fields" in kibana coordinate map visualization, Which wants geo_point type as field

4

You need to define mappings for geo point field before the index creation some thing like below

"MLGeo": {
            "type": "geo_point",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          }
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.