Hi
Sorry if I disturb you again but I after read many and many threads about this problem I still can't understand why my configuration simply won't work!
This i my logastash cofiguration:
input {
file {
type => "access_apache"
sincedb_path => "/dev/null"
path => "/usr/log_accesso_web.log"
start_position => beginning
ignore_older => 86400000
}
}
filter {
if [type] == "access_apache" {
csv {
columns => [
"clientIP",
"sslProt",
"chiper",
"sslClient",
"auth",
"timestamp",
"uniqueID",
"httpVersion",
"request",
"keepAlive",
"pathFolder",
"query",
"status",
"rBytes",
"header",
"referer",
"response",
"connection",
"bReceived",
"bSent"
]
separator =>" "
remove_field => ["message"]
}
geoip {
source => "clientIP"
database => "/etc/logstash/GeoLiteCity.dat"
}
mutate {
convert => ["keepAlive", "integer"]
convert => ["rBytes", "integer"]
convert => ["response", "integer"]
convert => ["bReceived", "integer"]
convert => ["bSent", "integer"]
convert => ["[geoip][postal_code]", "integer"]
convert => ["[geoip][latitude]", "float"]
convert => ["[geoip][longitude]", "float"]
}
}
if "_csvparsefailure" in [tags] {
mutate {
replace => { "type" => "failure_access_apache" }
}
}
}
output {
if [type] == "access_apache" {
elasticsearch {
hosts => ["192.168.122.128:9200"] #["192.168.122.104:9200", "192.168.122.238:9200", "192.168.122.55:9200"]
index => "apache-%{+YYYY.MM.dd}"
}
}
if [type] == "failure_access_apache" {
elasticsearch {
hosts => ["192.168.122.128:9200"] #["192.168.122.104:9200", "192.168.122.238:9200", "192.168.122.55:9200"]
index => "failure_access_apache-%{+YYYY.MM.dd}"
}
}
stdout { codec => rubydebug }
}
And this is the mapping of my template (I must cut most of the elements because exceeded the 5000 character limit):
"mappings": {
...
"geoip": {
"properties": {
"timezone": {
"type": "string"
},
"ip": {
"type": "string"
},
"latitude": {
"type": "float"
},
"country_code2": {
"type": "string"
},
"country_name": {
"type": "string"
},
"continent_code": {
"type": "string"
},
"country_code3": {
"type": "string"
},
"region_name": {
"type": "string"
},
"location": {
"type": "geo_point"
},
"real_region_name": {
"type": "string"
},
"postal_code": {
"type": "long"
},
"longitude": {
"type": "float"
}
}
},
....
When I try to ship the log i receive the follow error
"status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [geoip.location] of different type, current_type [geo_point], merged_type [long]"}}}, :level=>:warn}
Someone have an idea about what I'm doing wrong?
As always, may thanks.