How to create a geo_point field in logstash for a default index logstash-*

(George Cherian) #1


How to make a field geo_point type in logstash itself , so that I don't need to initial create a index manually with geo_point temple and the use it in logstash , which is double work.


(Mark Walkom) #2

You should leverage templates for your mappings, that is the best way if you are using a non logstash- named index.

(George Cherian) #3

how can it be done for logstash-named index?

(Mark Walkom) #4

Are you changing the name of the field, or using the defaults from the geoip filter?

(George Cherian) #5

I need the location field shown in the below snippet as geo_point , so for that can I use geoip plugin instead of mutate?

if[Site] == "Manassas"
add_field => { "location" => "38.7509,-77.4753" }

(Mark Walkom) #6

Ohh ok, now that makes sense. (Side note, posting your config can help get a resolution a bit quicker :slight_smile: )

You may need to adapt the existing template, because the default one by Logstash uses geoip.location but you are using just location. Otherwise, just call that field geoip.location.

(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.