# Help with filter to create Latitude and Longitude fields

**URL:** <https://discuss.elastic.co/t/help-with-filter-to-create-latitude-and-longitude-fields/366075>\
**Category:** Logstash\
**Created:** [September 5, 2024, 3:14am UTC](https://discuss.elastic.co/t/help-with-filter-to-create-latitude-and-longitude-fields/366075 "2024-09-05T03:14:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Big-Edd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/big-edd/32/131503_2.png) [@Big-Edd](https://discuss.elastic.co/u/Big-Edd)\
**Post date:** [September 5, 2024, 3:14am UTC](https://discuss.elastic.co/t/help-with-filter-to-create-latitude-and-longitude-fields/366075/1 "2024-09-05T03:14:55Z")

</div>

Hello,

Can I please have some help with a filter for this sample data?

```auto
{
    "took": 319,
    "timed_out": false,
    "_shards": {
        "total": 1,
        "successful": 1,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": {
            "value": 1784,
            "relation": "eq"
        },
        "max_score": 1.0,
        "hits": [
            {
                "_index": "index_for_some_data",
                "_id": "dkgirndy58gmdu69fys5",
                "_score": 1.0,
                "_source": {
                    "event": {
                        "original": "Return-Path: <some_one@some_where.com>\r\nX-Original-To: mailbox@needed.local\r\nReceived: from internal.host.local (internal.host.local .. [SNIP] .. \r\nSubject: Something of interset to us\r\n .. [SNIP] .. "
                    },
                    "message": "Return-Path: <some_one@some_where.com>\r\nX-Original-To: mailbox@needed.local\r\nReceived: from internal.host.local (internal.host.local .. [SNIP] .. \r\nSubject: Something of interset to us\r\n .. [SNIP] .. \r\n\r\nUnit Location: Lat = -31.80355 Long = 115.84676\r\n .. [SNIP] .. ",
                    "@version": "1",
                    "tags": [
                        "RabbitMQ",
                        "SMTP"
                    ],
                    "@timestamp": "2024-08-08T03:30:31.158337781Z"
                }
            },
.. [SNIP] ..  

```

Filter currently being used thanks to some help with my previous post looks like this.

```auto
filter {
  mutate { remove_field => ["event", "host", "log"] }
  grok {
    break_on_match => false
    match => {
      "message" => [
        "^X-Original-To: %{EMAILADDRESS:email_to}",
        "^Subject: %{DATA:email_subject}
" ] }
  }
}

```

In addition to email\_to and email\_subject, we would also like fields for unit\_location\_latitude and unit\_location\_longitude as well.

Cheers,  
Eddie.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 5, 2024, 4:04am UTC](https://discuss.elastic.co/t/help-with-filter-to-create-latitude-and-longitude-fields/366075/2 "2024-09-05T04:04:17Z")

</div>

> [@Big-Edd](#):
>
> In addition to email\_to and email\_subject, we would also like fields for unit\_location\_latitude and unit\_location\_longitude as well.

You can trivially add patterns to match the latitude and longitude.

```
            "message" => [
                "^X-Original-To: %{EMAILADDRESS:email_to}",
                "^Subject: %{DATA:email_subject}
",
                "Lat = %{NUMBER:latitude:float}",
                "Long = %{NUMBER:longitude:float}"
            ]

```

If you want to combine those to create a [geo\_point](https://www.elastic.co/guide/en/elasticsearch/reference/current/geo-point.html) in elasticsearch then you will need a [template](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-templates.html).