# Geo\_point and geohash in logstash

**URL:** <https://discuss.elastic.co/t/geo-point-and-geohash-in-logstash/202880>\
**Category:** Logstash\
**Created:** [October 9, 2019, 4:58pm UTC](https://discuss.elastic.co/t/geo-point-and-geohash-in-logstash/202880 "2019-10-09T16:58:39Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![rohitg](https://avatars.discourse-cdn.com/v4/letter/r/b77776/32.png) [@rohitg](https://discuss.elastic.co/u/rohitg)\
**Post date:** [October 9, 2019, 4:58pm UTC](https://discuss.elastic.co/t/geo-point-and-geohash-in-logstash/202880/1 "2019-10-09T16:58:39Z")

</div>

Hi,  
I am trying to use coordinate maps in kibana for my visualization.  
I mutate my longitude and latitude fields with rename and convert to float, but when i tried in Kibana, it showing no compactible field geo\_point.

Logstash:

input {

file

{

path =\> "G:/Transit/\*.csv"

start\_position =\> "beginning"

sincedb\_path =\> "F:\ELKstack\logstash\data\plugins\inputs\file\transit.txt"

}

}

filter {

csv {

separator =\> ","

columns =\> ["Unit#","Unit Name","Add1","City","Pr","Pcode","Country","Tel1","Access","W\_GMT","S\_GMT","LATITUDE","LONGTITUDE","NAME\_FRN","ADDR\_1\_FRN","Hrs\_Mon\_Op","Hrs\_Mon\_Cls","Hrs\_Tue\_Op","Hrs\_Tue\_Cls","Hrs\_Wed\_Op","Hrs\_Wed\_Cls","Hrs\_Thu\_Op","Hrs\_Thu\_Cls","Hrs\_Fri\_Op","Hrs\_Fri\_Cls","Hrs\_Sat\_Op","Hrs\_Sat\_Cls","Hrs\_Sun\_Op","Hrs\_Sun\_Cls","LANG\_SERVICES","Close Date","Forced Relo?","FY 2019","F24"]

}

mutate { convert =\> { "LONGTITUDE" =\> "float"}}

mutate { convert =\> { "LATITUDE" =\> "float"}}

mutate {rename =\> ["LONGTITUDE", "Location(lon)"]}

mutate {rename =\> ["LATITUDE", "Location(lat)"]}

mutate {rename =\> ["Unit#", "TransitId"]}

mutate {rename =\> ["City", "City"]}

mutate {rename =\> ["Add1", "Address"]}

mutate {rename =\> ["Pr", "Province"]}

mutate {rename =\> ["Pcode", "Postal Code"]}

#mutate {rename =\> ["my\_Region", "Region"]}

mutate {remove\_field =\> ["Unit Name","Country","Tel1","Access","W\_GMT","S\_GMT","LATITUDE","LONGTITUDE","NAME\_FRN","ADDR\_1\_FRN","Hrs\_Mon\_Op","Hrs\_Mon\_Cls","Hrs\_Tue\_Op","Hrs\_Tue\_Cls","Hrs\_Wed\_Op","Hrs\_Wed\_Cls","Hrs\_Thu\_Op","Hrs\_Thu\_Cls","Hrs\_Fri\_Op","Hrs\_Fri\_Cls","Hrs\_Sat\_Op","Hrs\_Sat\_Cls","Hrs\_Sun\_Op","Hrs\_Sun\_Cls","LANG\_SERVICES","Close Date","Forced Relo?","FY 2019","F24","my\_Region"]}

}

output {

stdout { codec =\> rubydebug }

elasticsearch {

action =\> "index"

hosts =\> "[https://127.0.0.1:9200](https://127.0.0.1:9200)"

index =\> "branchres-transit"

cacert =\> "/ELKstack/logstash/config/certs/ca/ca.crt"

user =\> "logstash\_writer"

password =\> "password"

manage\_template =\> false

}

}

 ![kibana](https://us1.discourse-cdn.com/elastic/original/3X/9/2/928955b9f2aa4d92e22a7d562e36ab1e9671705f.jpeg)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 9, 2019, 5:16pm UTC](https://discuss.elastic.co/t/geo-point-and-geohash-in-logstash/202880/2 "2019-10-09T17:16:31Z")

</div>

> [@rohitg](#):
>
> mutate {rename =\> ["LONGTITUDE", "Location(lon)"]}

That should be

```
mutate {rename => { "LONGTITUDE" => "[Location][lon]" } }

```

Also, you will [need](https://www.elastic.co/guide/en/elasticsearch/reference/current/geo-point.html) an index template that tells elasticsearch that Location is a geo\_point.

---

<div class="post-metadata">

**Author:** ![rohitg](https://avatars.discourse-cdn.com/v4/letter/r/b77776/32.png) [@rohitg](https://discuss.elastic.co/u/rohitg)\
**Post date:** [October 9, 2019, 6:14pm UTC](https://discuss.elastic.co/t/geo-point-and-geohash-in-logstash/202880/3 "2019-10-09T18:14:24Z")

</div>

Thanks Badger.

---

<div class="post-metadata">

**Author:** ![rohitg](https://avatars.discourse-cdn.com/v4/letter/r/b77776/32.png) [@rohitg](https://discuss.elastic.co/u/rohitg)\
**Post date:** [October 10, 2019, 2:24pm UTC](https://discuss.elastic.co/t/geo-point-and-geohash-in-logstash/202880/4 "2019-10-10T14:24:01Z")

</div>

Hi,  
I am getting an error. Can you help to resolve it.

[2019-10-10T10:17:16,107][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"branchres-transit", :\_type=\>"\_doc", :routing=\>nil}, #LogStash::Event:0x66b9b5b], :response=\>{"index"=\>{"\_index"=\>"branchres-transit", "\_type"=\>"\_doc", "\_id"=\>"x-kHtm0Bu8ReViWd7er9", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse field [location] of type [geo\_point]", "caused\_by"=\>{"type"=\>"parse\_exception", "reason"=\>"unsupported symbol [L] in geohash [LONGTITUDE LATITUDE]", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"unsupported symbol [L] in geohash [LONGTITUDE LATITUDE]"}}}}}}

My Index template:  
PUT \_template/transit  
{  
"index\_patterns":"branchres-transit",  
"mappings":{  
"properties":{  
"location":{  
"properties": {  
"lat": {  
"type": "geo\_point"  
},  
"lon": {  
"type": "geo\_point"  
}  
}  
}  
}  
}  
}

Logstash config:

input {  
file  
{  
path =\> "G:/Transit/\*.csv"   
start\_position =\> "beginning"  
sincedb\_path =\> "F:\ELKstack\logstash\data\plugins\inputs\file\transit.txt"  
}  
}  
filter {  
csv {  
separator =\> ","  
columns =\> ["Unit#","Unit Name","Add1","City","Pr","Pcode","Country","Tel1","Access","W\_GMT","S\_GMT","LATITUDE","LONGTITUDE","NAME\_FRN","ADDR\_1\_FRN","Hrs\_Mon\_Op","Hrs\_Mon\_Cls","Hrs\_Tue\_Op","Hrs\_Tue\_Cls","Hrs\_Wed\_Op","Hrs\_Wed\_Cls","Hrs\_Thu\_Op","Hrs\_Thu\_Cls","Hrs\_Fri\_Op","Hrs\_Fri\_Cls","Hrs\_Sat\_Op","Hrs\_Sat\_Cls","Hrs\_Sun\_Op","Hrs\_Sun\_Cls","LANG\_SERVICES","Close Date","Forced Relo?","FY 2019","F24"]}

# 

mutate {  
add\_field =\> { "location" =\> "%{[Location][lon]} %{[Location][lat]}" }  
rename =\> { "LONGTITUDE" =\> "[Location][lon]" }  
rename =\> { "LATITUDE" =\> "[Location][lat]" }  
convert =\> { "[LONGTITUDE]" =\> "float" }  
convert =\> { "[LATITUDE]" =\> "float" }  
}

# 

mutate {rename =\> ["Unit#", "TransitId"]}  
mutate {rename =\> ["City", "City"]}  
mutate {rename =\> ["Add1", "Address"]}  
mutate {rename =\> ["Pr", "Province"]}  
mutate {rename =\> ["Pcode", "Postal Code"]}  
#mutate {rename =\> ["Region", "Region"]}  
mutate {remove\_field =\> ["Unit Name","Country","Tel1","Access","W\_GMT","S\_GMT","LATITUDE","LONGTITUDE","NAME\_FRN","ADDR\_1\_FRN","Hrs\_Mon\_Op","Hrs\_Mon\_Cls","Hrs\_Tue\_Op","Hrs\_Tue\_Cls","Hrs\_Wed\_Op","Hrs\_Wed\_Cls","Hrs\_Thu\_Op","Hrs\_Thu\_Cls","Hrs\_Fri\_Op","Hrs\_Fri\_Cls","Hrs\_Sat\_Op","Hrs\_Sat\_Cls","Hrs\_Sun\_Op","Hrs\_Sun\_Cls","LANG\_SERVICES","Close Date","Forced Relo?","FY 2019","F24","Region"]}  
}  
output {  
stdout { codec =\> rubydebug }  
elasticsearch {  
action =\> "index"  
hosts =\> "[https://127.0.0.1:9200](https://127.0.0.1:9200)"  
index =\> "branchres-transit"  
cacert =\> "/ELKstack/logstash/config/certs/ca/ca.crt"  
user =\> "logstash\_writer"  
password =\> "password"  
manage\_template =\> false  
template\_name =\> "transit"  
}  
}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 10, 2019, 4:38pm UTC](https://discuss.elastic.co/t/geo-point-and-geohash-in-logstash/202880/5 "2019-10-10T16:38:02Z")

</div>

> [@rohitg](#):
>
> add\_field =\> { "location" =\> "%{[Location][lon]} %{[Location][lat]}" }

When specifying a geo\_point as a string the fields should be comma separated, so this should be

```
add_field => { "location" => "%{[Location][lon]},%{[Location][lat]}" }

```

---

<div class="post-metadata">

**Author:** ![rohitg](https://avatars.discourse-cdn.com/v4/letter/r/b77776/32.png) [@rohitg](https://discuss.elastic.co/u/rohitg)\
**Post date:** [October 10, 2019, 5:14pm UTC](https://discuss.elastic.co/t/geo-point-and-geohash-in-logstash/202880/6 "2019-10-10T17:14:12Z")

</div>

Thanks. I've changed the add\_field but now i am getting different kind of error:

[2019-10-10T13:00:22,403][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"branchres-transit", :\_type=\>"\_doc", :routing=\>nil}, #LogStash::Event:0x2fb4c248], :response=\>{"index"=\>{"\_index"=\>"branchres-transit", "\_type"=\>"\_doc", "\_id"=\>"CRudtm0Bu8ReViWdQQSG", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"object mapping for [location] tried to parse field [location] as object, but found a concrete value"}}}}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 10, 2019, 5:21pm UTC](https://discuss.elastic.co/t/geo-point-and-geohash-in-logstash/202880/7 "2019-10-10T17:21:37Z")

</div>

> [@rohitg](#):
>
> mapper\_parsing\_exception

Can you delete the index and start over?

---

<div class="post-metadata">

**Author:** ![rohitg](https://avatars.discourse-cdn.com/v4/letter/r/b77776/32.png) [@rohitg](https://discuss.elastic.co/u/rohitg)\
**Post date:** [October 10, 2019, 5:32pm UTC](https://discuss.elastic.co/t/geo-point-and-geohash-in-logstash/202880/8 "2019-10-10T17:32:34Z")

</div>

No luck even after deleting Index and start over - got same mapper\_parsing\_exception.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 10, 2019, 5:55pm UTC](https://discuss.elastic.co/t/geo-point-and-geohash-in-logstash/202880/9 "2019-10-10T17:55:15Z")

</div>

In your stdout rubydebug output what does the location field look like?

---

<div class="post-metadata">

**Author:** ![rohitg](https://avatars.discourse-cdn.com/v4/letter/r/b77776/32.png) [@rohitg](https://discuss.elastic.co/u/rohitg)\
**Post date:** [October 10, 2019, 6:59pm UTC](https://discuss.elastic.co/t/geo-point-and-geohash-in-logstash/202880/10 "2019-10-10T18:59:10Z")

</div>

Hi Badger,

rubydebug output: "location" =\> "-123.5100, 45.4243" and "Location" =\> {  
"lon" =\> "-123.5100",  
"lat" =\> "45.4243"

```
 "message" => "372 & 49TH , MAIN ST,3H1,CA,6042352472,True,-8,-7,41.228806,-103.1078,\"\",\"\",09:30,18:00,09:30,18:00,09:30,18:00,09:30,18:00,09:30,18:00,09:00,16:00,\"\",\"\",\"English, French, Mandarin Chinese, \",,,,\r"

```

}  
{  
"Province" =\> "po",  
"@version" =\> "1",  
"@timestamp" =\> 2019-10-10T18:51:22.850Z,  
"location" =\> "-123.5100, 45.4243",  
"TransitId" =\> "300",  
"Address" =\> "1114 RD",  
"Postal Code" =\> "xxxxx",  
"host" =\> "xxxxx",  
"City" =\> "ED",  
"path" =\> "G:/Tran/2019-09-05.csv",  
"Location" =\> {  
"lon" =\> "-123.5100",  
"lat" =\> "45.4243"  
}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 10, 2019, 7:17pm UTC](https://discuss.elastic.co/t/geo-point-and-geohash-in-logstash/202880/11 "2019-10-10T19:17:22Z")

</div>

Your index template should include something like

```
"mappings": {
  "properties": {
    "location": {
      "type": "geo_point"
    }
  }
}

```

I suspect it doesn't.

---

<div class="post-metadata">

**Author:** ![rohitg](https://avatars.discourse-cdn.com/v4/letter/r/b77776/32.png) [@rohitg](https://discuss.elastic.co/u/rohitg)\
**Post date:** [October 10, 2019, 7:25pm UTC](https://discuss.elastic.co/t/geo-point-and-geohash-in-logstash/202880/12 "2019-10-10T19:25:44Z")

</div>

I've changed my index template, now again same "mapper\_parsing\_exception" error:

[2019-10-10T15:20:59,482][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"branchres-transit", :\_type=\>"\_doc", :routing=\>nil}, #LogStash::Event:0x77fec1ff], :response=\>{"index"=\>{"\_index"=\>"branchres-transit", "\_type"=\>"\_doc", "_id"=\>"rUYdt20Bu8ReViWd\_h5_", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse field [location] of type [geo\_point]", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"illegal latitude value [-104.6098] for location"}}}}}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 10, 2019, 7:46pm UTC](https://discuss.elastic.co/t/geo-point-and-geohash-in-logstash/202880/13 "2019-10-10T19:46:48Z")

</div>

That's an improvement! latitude goes from -90 to +90. What do you want -104.6098 to mean? Do you have latititude and longitude the wrong way around?

---

<div class="post-metadata">

**Author:** ![rohitg](https://avatars.discourse-cdn.com/v4/letter/r/b77776/32.png) [@rohitg](https://discuss.elastic.co/u/rohitg)\
**Post date:** [October 10, 2019, 8:28pm UTC](https://discuss.elastic.co/t/geo-point-and-geohash-in-logstash/202880/14 "2019-10-10T20:28:07Z")

</div>

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 7, 2019, 8:28pm UTC](https://discuss.elastic.co/t/geo-point-and-geohash-in-logstash/202880/15 "2019-11-07T20:28:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.