curl to submit the template
curl -XPUT 'http://staging-elkstack:9200/_template/elkstats_template' -d '
{
"order" : 2,
"template": "template_test*",
"settings": {
"number_of_shards" : 8,
"number_of_replicas" : 0
},
"mappings" : {
"log" : {
"_all" : {"enabled" : false, "omit_norms" : true},
"properties" : {
"geopoint": {
"type": "geo_point"
}
}
}
}
}
'
logstash conf file
input{stdin{}}
filter {
json { source => "message" }
ruby {
#generate geopoint field
code => " event['geopoint'] = [ event['longitude'], event['latitude'] ];
"
}
}
output {
stdout { codec => rubydebug }
elasticsearch {
hosts => "staging-elkstack:9200"
index => "template_test"
template_name => "elkstats_template"
}
}
input
{ "longitude":-73.758, "latitude":41.0291}
response:
{
"message" => "{ "longitude":-73.758, "latitude":41.0291}",
"@version" => "1",
"@timestamp" => "2016-04-28T13:59:34.989Z",
"host" => "staging-elkstack",
"longitude" => -73.758,
"latitude" => 41.0291,
"geopoint" => [
[0] -73.758,
[1] 41.0291
]
}
Failed action. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"template_test", :_type=>"logs", :_routing=>nil}, #<LogStash::Event:0x29a3fe4e @metadata_accessors=#<LogStash::Util::Accessors:0xaa19e3 @store={}, @lut={}>, @cancelled=false, @data={"message"=>"{ "longitude":-73.758, "latitude":41.0291}", "@version"=>"1",
...
BigDecimal:ba3f33c,'-0.73758E2',5(8), "latitude"=>#BigDecimal:127d81fd,'0.410291E2',6(8), "geopoint"=>[#BigDecimal:ba3f33c,'-0.73758E2',5(8), #BigDecimal:127d81fd,'0.410291E2',6(8)]}, "latitude"], "geopoint"=>[{"message"=>"{ "longitude":-73.758, "latitude":41.0291}", "@version"=>"1", "@timestamp"=>"2016-04-28T13:59:34.989Z", "host"=>"staging-elkstack", "longitude"=>#BigDecimal:ba3f33c,'-0.73758E2',5(8), "latitude"=>#BigDecimal:127d81fd,'0.410291E2',6(8), "geopoint"=>[#BigDecimal:ba3f33c,'-0.73758E2',5(8), #BigDecimal:127d81fd,'0.410291E2',6(8)]}, "geopoint"], "type"=>[{"message"=>"{ "longitude":-73.758, "latitude":41.0291}", "@version"=>"1", "@timestamp"=>"2016-04-28T13:59:34.989Z", "host"=>"staging-elkstack", "longitude"=>#BigDecimal:ba3f33c,'-0.73758E2',5(8), "latitude"=>#BigDecimal:127d81fd,'0.410291E2',6(8), "geopoint"=>[#BigDecimal:ba3f33c,'-0.73758E2',5(8), #BigDecimal:127d81fd,'0.410291E2',6(8)]}, "type"]}>>], :response=>{"create"=>{"_index"=>"template_test", "_type"=>"logs", "_id"=>"AVRdKu_VWBYWdrvdTG5E", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Mixing up field types: class org.elasticsearch.index.mapper.core.DoubleFieldMapper$DoubleFieldType != class org.elasticsearch.index.mapper.geo.BaseGeoPointFieldMapper$GeoPointFieldType on field geopoint"}}}}, :level=>:warn}
I am using elasticsearch 2.3.1 and logstash 2.2.4