# Giop in logstash file

**URL:** <https://discuss.elastic.co/t/giop-in-logstash-file/248971>\
**Category:** Logstash\
**Created:** [September 17, 2020, 12:00pm UTC](https://discuss.elastic.co/t/giop-in-logstash-file/248971 "2020-09-17T12:00:13Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![hiba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hiba/32/110919_2.png) [@hiba](https://discuss.elastic.co/u/hiba)\
**Post date:** [September 17, 2020, 12:00pm UTC](https://discuss.elastic.co/t/giop-in-logstash-file/248971/1 "2020-09-17T12:00:13Z")

</div>

I create a giop filed in my logstash config file (location).

In my data source the latitude and the longitude fields can be an empty string.  
so whene i load data into elasticserach i lose all the documents wich have this empty fields.

[2020-09-17T12:56:30,368][WARN][logstash.outputs.elasticsearch][main][42d2611b98bc06a090ed5c6a07b113b86623d] Could not index event to Elasticsearch. {:status=\>400, :action=\>["update", {:\_id=\>"17164", :\_index=\>"hotels", :routing=\>nil, :\_type=\>"\_doc", :retry\_on\_conflict=\>1}, #LogStash::Event:0x151670a5], :response=\>{"update"=\>{"\_index"=\>"hotels", "\_type"=\>"\_doc", "\_id"=\>"17164", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse field [long] of type [float] in document with id '17164'. Preview of field's value: '10.5618093,17'", "caused\_by"=\>{"type"=\>"number\_format\_exception", "reason"=\>"For input string: "10.5618093,17""}}}}}  
[2020-09-17T12:56:30,372][WARN][logstash.outputs.elasticsearch][main][42d2611b98bc06a090ed5c6a07b113b86623d79c5] Could not index event to Elasticsearch. {:status=\>400, :action=\>["update", {:\_id=\>"17283", :\_index=\>"hotels", :routing=\>nil, :\_type=\>"\_doc", :retry\_on\_conflict=\>1}, #LogStash::Event:0xf5abdd5], :response=\>{"update"=\>{"\_index"=\>"hotels", "\_type"=\>"\_doc", "\_id"=\>"17283", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse field [lat] of type [float] in document with id '17283'. Preview of field's value: '33.877462,7'", "caused\_by"=\>{"type"=\>"number\_format\_exception", "reason"=\>"For input string: "33.877462,7""}}}}}

My config file

input {  
http\_poller {  
urls =\> {  
url =\> "XXXXXX"  
}  
request\_timeout =\> 60  
schedule =\> { every =\> "60s" }  
codec =\> "json"  
}  
}  
filter {  
split { field =\> "[hotels]" }  
mutate {  
rename =\> {  
"[hotels][hotelId]" =\> "hotelId"  
"[hotels][name]" =\> "name"  
"[hotels][rating]" =\> "rating"  
"[hotels][marketingtext]" =\> "marketingtext"  
"[hotels][lat]" =\> "lat"  
"[hotels][long]" =\> "long"  
"[hotels][score]" =\> "score"  
"[hotels][address]" =\> "address"  
"[hotels][addressSuite]" =\> "addressSuite"  
"[hotels][postCode]" =\> "postCode"  
"[hotels][cityId]" =\> "cityId"  
"[hotels][countryId]" =\> "countryId"  
"[hotels][zoneId]" =\> "zoneId"  
"[hotels][hotelChainId]" =\> "hotelChainId"  
"[hotels][distanceCity]" =\> "distanceCity"  
"[hotels][distanceAirport]" =\> "distanceAirport"  
"[hotels][photos]" =\> "photos"  
"[hotels][themes]" =\> "themes"  
"[hotels][facilities]" =\> "facilities"  
"[hotels][descriptions]" =\> "descriptions"  
}  
add\_field =\> {"location" =\> "%{lat},%{long}"}  
remove\_field =\> ["marketingtext", "addressSuite", "postCode", "photos", "themes", "facilities", "descriptions"]  
}  
}  
output {  
elasticsearch {  
user =\> XXXXX  
password =\> XXXX  
hosts =\> "localhost:9200"  
index =\> "hotels"  
action =\> "update"  
doc\_as\_upsert =\> "true"  
document\_id =\> "%{hotelId}"  
}  
stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 17, 2020, 10:42pm UTC](https://discuss.elastic.co/t/giop-in-logstash-file/248971/2 "2020-09-17T22:42:15Z")

</div>

Do you mean geoip, not giop?

---

<div class="post-metadata">

**Author:** ![hiba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hiba/32/110919_2.png) [@hiba](https://discuss.elastic.co/u/hiba)\
**Post date:** [September 17, 2020, 10:57pm UTC](https://discuss.elastic.co/t/giop-in-logstash-file/248971/3 "2020-09-17T22:57:54Z")

</div>

Oh yes i'm sorry.  
Geiop

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 17, 2020, 10:59pm UTC](https://discuss.elastic.co/t/giop-in-logstash-file/248971/4 "2020-09-17T22:59:33Z")

</div>

What it's saying here;

> [@hiba](#):
>
> For input string: "33.877462,7"

Is that it's received `33.877462,7` as a number to put into a float field. But that's not a valid number. You will need to figure out where that is coming from.

---

<div class="post-metadata">

**Author:** ![hiba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hiba/32/110919_2.png) [@hiba](https://discuss.elastic.co/u/hiba)\
**Post date:** [September 17, 2020, 11:15pm UTC](https://discuss.elastic.co/t/giop-in-logstash-file/248971/5 "2020-09-17T23:15:53Z")

</div>

How can i do this please.  
Also i got an error whene the latitude ana longitude are an empty string. ...i can't load the documents into elasticsearch

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 17, 2020, 11:17pm UTC](https://discuss.elastic.co/t/giop-in-logstash-file/248971/6 "2020-09-17T23:17:12Z")

</div>

If it's empty you will need to fill it with some fake data, maybe just use `0, 0`.

---

<div class="post-metadata">

**Author:** ![hiba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hiba/32/110919_2.png) [@hiba](https://discuss.elastic.co/u/hiba)\
**Post date:** [September 18, 2020, 8:52am UTC](https://discuss.elastic.co/t/giop-in-logstash-file/248971/7 "2020-09-18T08:52:26Z")

</div>

I got this error :

{:\_id=\>"19560", :\_index=\>"hotels", :routing=\>nil, :\_type=\>"\_doc", :retry\_on\_conflict=\>1}, #LogStash::Event:0x52e6d07], :response=\>{"update"=\>{"\_index"=\>"hotels", "\_type"=\>"\_doc", "\_id"=\>"19560", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse field [location] of type [geo\_point]", "caused\_by"=\>{"type"=\>"array\_index\_out\_of\_bounds\_exception", "reason"=\>"Index 0 out of bounds for length 0"}}}}}

this is my filter:

filter {  
split { field =\> "[hotels]" }  
mutate {  
rename =\> {  
"[hotels][hotelId]" =\> "hotelId"  
"[hotels][name]" =\> "name"  
"[hotels][rating]" =\> "rating"  
"[hotels][marketingtext]" =\> "marketingtext"  
"[hotels][lat]" =\> "lat"  
"[hotels][long]" =\> "long"  
"[hotels][score]" =\> "score"  
"[hotels][address]" =\> "address"  
"[hotels][addressSuite]" =\> "addressSuite"  
"[hotels][postCode]" =\> "postCode"  
"[hotels][cityId]" =\> "cityId"  
"[hotels][countryId]" =\> "countryId"  
"[hotels][zoneId]" =\> "zoneId"  
"[hotels][hotelChainId]" =\> "hotelChainId"  
"[hotels][distanceCity]" =\> "distanceCity"  
"[hotels][distanceAirport]" =\> "distanceAirport"  
"[hotels][photos]" =\> "photos"  
"[hotels][themes]" =\> "themes"  
"[hotels][facilities]" =\> "facilities"  
"[hotels][descriptions]" =\> "descriptions"  
}  
add\_field =\> {"location" =\> "%{lat},%{long}"}  
remove\_field =\> ["marketingtext", "addressSuite", "postCode", "photos", "themes", "facilities", "descriptions"]  
}  
if ![location]{  
mutate {  
update =\> {"location" =\> "0,0" }  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 16, 2020, 8:52am UTC](https://discuss.elastic.co/t/giop-in-logstash-file/248971/8 "2020-10-16T08:52:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.