# Geo point in logstash

**URL:** <https://discuss.elastic.co/t/geo-point-in-logstash/73851>\
**Category:** Logstash\
**Created:** [February 3, 2017, 12:41pm UTC](https://discuss.elastic.co/t/geo-point-in-logstash/73851 "2017-02-03T12:41:49Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dan](https://avatars.discourse-cdn.com/v4/letter/d/eada6e/32.png) [@Dan](https://discuss.elastic.co/u/Dan)\
**Post date:** [February 3, 2017, 12:41pm UTC](https://discuss.elastic.co/t/geo-point-in-logstash/73851/1 "2017-02-03T12:41:49Z")

</div>

My input as CSV and output as elastic search.

in my csv file having one column **location** which is holding value latitude and longitude information.

for example-72.8799,32.46567(attitude,longitude)  
i am using below filter to convert into geo point.  
geoip {  
source =\> "location"  
target =\> "geoip"

```
  add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
  add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
}
mutate {
  convert => ["[geoip][coordinates]", "float"]
}

```

But it not converting location field into geo\_type.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [February 5, 2017, 9:48am UTC](https://discuss.elastic.co/t/geo-point-in-logstash/73851/2 "2017-02-05T09:48:28Z")

</div>

Are you having problems? If so explaining what they are will be helpful.

---

<div class="post-metadata">

**Author:** ![Dan](https://avatars.discourse-cdn.com/v4/letter/d/eada6e/32.png) [@Dan](https://discuss.elastic.co/u/Dan)\
**Post date:** [February 6, 2017, 6:26am UTC](https://discuss.elastic.co/t/geo-point-in-logstash/73851/3 "2017-02-06T06:26:10Z")

</div>

That field not recognising as geo point filed in Kibana.

I am getting below error in my logstsh log file.

[2017-02-06T11:53:09,933][DEBUG][logstash.filters.geoip] IP was not found in the database.

But this ip was available.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 6, 2017, 7:10am UTC](https://discuss.elastic.co/t/geo-point-in-logstash/73851/4 "2017-02-06T07:10:54Z")

</div>

Your filter will not turn the `location` field into a geo\_point field, but `[geoip][coordinates]` will be if the geoip filter is successful.

> But this ip was available.

What is the IP?

---

<div class="post-metadata">

**Author:** ![Dan](https://avatars.discourse-cdn.com/v4/letter/d/eada6e/32.png) [@Dan](https://discuss.elastic.co/u/Dan)\
**Post date:** [February 6, 2017, 8:07am UTC](https://discuss.elastic.co/t/geo-point-in-logstash/73851/5 "2017-02-06T08:07:14Z")

</div>

42.100533,-91.443321

above is the value location column had.

but in the logstsh log file its taking 127.0.0.1.

42.100533,-91.443321 this value is corresponding latitude,longtude.

---

<div class="post-metadata">

**Author:** ![Dan](https://avatars.discourse-cdn.com/v4/letter/d/eada6e/32.png) [@Dan](https://discuss.elastic.co/u/Dan)\
**Post date:** [February 6, 2017, 8:12am UTC](https://discuss.elastic.co/t/geo-point-in-logstash/73851/6 "2017-02-06T08:12:33Z")

</div>

```
    Location lattitue longitude
42.100533,-91.443321 42.100533 91.443321

```

Above is the csv file which is holding location,lattitude,longitude

i want to make location column as geo\_type.

geoip {  
source =\> "location"  
target =\> "geoip"

add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ]  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ]  
}  
mutate {  
convert =\> ["[geoip][coordinates]", "float"]  
}

using above filter but i am not able to make it.

Please suggest me how i can i do that.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 6, 2017, 8:47am UTC](https://discuss.elastic.co/t/geo-point-in-logstash/73851/7 "2017-02-06T08:47:12Z")

</div>

I don't understand. The geoip filter converts IP addresses to lat/lon values. Are you saying that the `location` field contains "42.100533,-91.443321"? And you're trying to process that with the geoip filter?

---

<div class="post-metadata">

**Author:** ![Dan](https://avatars.discourse-cdn.com/v4/letter/d/eada6e/32.png) [@Dan](https://discuss.elastic.co/u/Dan)\
**Post date:** [February 6, 2017, 9:35am UTC](https://discuss.elastic.co/t/geo-point-in-logstash/73851/8 "2017-02-06T09:35:44Z")

</div>

ohhhh.ok geoip convert ip address to lat & long.

Please help me how can i make location as geo point column.

Location is the column which holds lat,long

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 6, 2017, 9:52am UTC](https://discuss.elastic.co/t/geo-point-in-logstash/73851/9 "2017-02-06T09:52:53Z")

</div>

I think geo\_point type accepts strings with two comma-separated floating point values. Otherwise the mutate filter's split option allows you to split the string into an array with two values. You may have to convert them to float values after the split.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 6, 2017, 9:53am UTC](https://discuss.elastic.co/t/geo-point-in-logstash/73851/10 "2017-03-06T09:53:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.