Geoip "illegal latitude" after upgrading 1.5 -> 2.1

Elastic Stack Logstash
1

I've just upgraded some boxes from 1.5 to 2.1 and have been getting indexing errors for all messages containing geoip data ever since.

Messages that don't contain geoip info are indexing without errors.

As far as I can see there is no issue with any of the message fields and the geoip filter seems to be working fine: http://pastebin.com/GQazrcBK

However the error message says otherwise: http://pastebin.com/05WwHg9S

There are tens of thousands of these error messages, but the range of latitudes in the error message are all between 264 and 269. As you can see from the error above it's complaining about 269.82421875 however the actual latitude in the message is -41.0, so I'm not sure where these values are even coming from.

Ubuntu 14.04.3
Elasticsearch 2.1.1
Logstash 2.1.1
logstash-filter-geoip 2.0.4

I'm completely stumped here. Can anyone help?
Thanks :slight_smile:

2

What does your mapping look like for that index?

3

@Christian_Dahlqvist I have a template mapping for [geoip][location] of "geo_point". There's no actual mapping in that index for type:nginx-access - I guess as no records with a location field have been indexed yet.

Do you need to see the full mapping output?

4

Any ideas what I can do here?

If I remove the mapping it gets indexed as a string, which is no use to me.

The only thing I can think do at this point to avoid message loss is to disable the geoip filter, which isn't ideal either.

5

I had the same issue. Realised that the issue was that I was passing the geo_points as a String array ["12.947787499999999", "80.2352166"] in my document. I changed it to a double array [12.947787499999999, 80.2352166] and it worked fine. Yes, the error message is completely misleading.