my logstash.conf:
geoip {
source => "client_ip"
target => "geoip"
}
mutate {
add_field => [ "mylocation", "%{[geoip][location]}" ]
}
In the error below notice that geoip.latitude and geoip.longitude values are populated properly...but the geoip.location field values are reversed. As a result the coordinates are wrong and many of the entries throw the following error when added:
"geoip"=>{
"ip"=>"xx.xx.xx.xx",
"latitude"=>53.6867,
"longitude"=>-113.7102
"location"=>[-113.7102, 53.6867]
}
response=>{
"create"=>{
"status"=>400, "error"=>{
"type"=>"mapper_parsing_exception",
"reason"=>"failed to parse",
"caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"illegal latitude value [-113.7102] for mylocation"}
}
}
}