GeoPoint

Elastic Stack Elasticsearch
1

Hello;

My csv File contain two seperated ( with pipe) columns longititude and latitude ... How can i put them to a single GeoPoint Location??

PUT /GeoLoc
{
    "mappings": {
        "doc": {
            "properties": {
                "location": {
                    "type": "geo_point"
                }
            }
        }
    }
}
2

Generally, you would insert the data as follows:

PUT GeoLoc/doc/1
{ 
  "location": {
    "lat": 41.12,
    "lon": -71.34
  }
}

This is further described in the Geopoint documentation.

Now, it depends how you are ingesting data into Elasticsearch. Are you using Beats, Logstash, or some other homebrewn solution?

3

this insert is a single point. I have to put file with 1000 geoPoint

4

Sure, that's why I was asking for additional details of your setup. You can either fire 1000 PUT operations from your own application, or use Logstash or Filebeat to process your file. All of these are valid solutions, but it depends. Any of them might be the best in your case.

Please also look into the Logstash link that I provided. It will give you an idea on how to configure Logstash to achieve what you want using the mutate filter.

5

thank you Florian,

what about GeoIp if I have a column named ipAddress.

6

Hi Mheni,

Can you please be more precise? What is the content of this column? What is its data format? What do you want achieve with the data that's in it?

Please be very specific when asking questions and do provide examples. Otherwise, it is very hard to know what you want to achieve and thus impossible to help.

7

the structure of my csv file ; 4 columns sepratad by | containing Date, Time, Source Ip Adress and Destination IpAddress. How can i configure Logstash to put these Ip on Map?

Date|Time|Source|destination
20180308|235537|78.191.69.130|78.191.68.189

8

Your Logstash configuration below. Please also see the documentation on Logstash geoip filter and Logstash csv filter.

input {
  file {
    path => "input.csv"
  }
}

filter {
  csv {
    separator => "|"
    columns => [ "date", "time", "source", "destination" ]
  }
  geoip {
    source => "source"
    target => "geoip_source"
  }
  geoip {
    source => "destination"
    target => "geoip_destination"
  }
}

output {
  elasticsearch {
    index => "geoip-example"
  }
}
9

Thank you Florient,
And for Kibana how to put the Mapping, and how to visualise all sources IP for example.

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.