Geo point in logstash

Elastic Stack Logstash
1

My input as CSV and output as elastic search.

in my csv file having one column location which is holding value latitude and longitude information.

for example-72.8799,32.46567(attitude,longitude)
i am using below filter to convert into geo point.
geoip {
source => "location"
target => "geoip"

  add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
  add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
}
mutate {
  convert => [ "[geoip][coordinates]", "float"]
}

But it not converting location field into geo_type.

2

Are you having problems? If so explaining what they are will be helpful.

3

That field not recognising as geo point filed in Kibana.

I am getting below error in my logstsh log file.

[2017-02-06T11:53:09,933][DEBUG][logstash.filters.geoip ] IP was not found in the database.

But this ip was available.

4

Your filter will not turn the location field into a geo_point field, but [geoip][coordinates] will be if the geoip filter is successful.

But this ip was available.

What is the IP?

5

42.100533,-91.443321

above is the value location column had.

but in the logstsh log file its taking 127.0.0.1.

42.100533,-91.443321 this value is corresponding latitude,longtude.

6 
    Location                          	lattitue	     longitude
42.100533,-91.443321 	               42.100533	    91.443321

Above is the csv file which is holding location,lattitude,longitude

i want to make location column as geo_type.

geoip {
source => "location"
target => "geoip"

add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
}
mutate {
convert => [ "[geoip][coordinates]", "float"]
}

using above filter but i am not able to make it.

Please suggest me how i can i do that.

7

I don't understand. The geoip filter converts IP addresses to lat/lon values. Are you saying that the location field contains "42.100533,-91.443321"? And you're trying to process that with the geoip filter?

8

ohhhh.ok geoip convert ip address to lat & long.

Please help me how can i make location as geo point column.

Location is the column which holds lat,long

9

I think geo_point type accepts strings with two comma-separated floating point values. Otherwise the mutate filter's split option allows you to split the string into an array with two values. You may have to convert them to float values after the split.