How to create map based on longitude, latitude fileds?

[namcx]

Hi Experts,

I had add 2 field with name lat,lon and value 21.033333, 105.849998 to index by logstash filter plugin "mutate"
if [fields][Contract] =~ "HNH" {
mutate {
add_field => [ "city", "Hanoi" ]
add_field => [ "lat", 21.033333 ]
add_field => [ "lon", 105.849998 ]
}
}
Then, i convert lat, lon to "float"
mutate {
convert => {
"lat" => "float"
"lon" => "float"
}
add_field => {
"[geoip][location]" => [ "%{lon}", "%{lat}" ]
"[geoip][latitude]" => "%{lat}"
"[geoip][longitude]" => "%{lon}"
}

}

But when start logstash, logstash show errror: "[2016-11-21T10:06:41,507][WARN ][logstash.outputs.elasticsearch] Failed action. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-test", :_type=>"fboxs", :_routing=>nil}, 2016-11-09T01:00:24.670Z 0.0.0.0 -], :response=>{"index"=>{"_index"=>"logstash-test", "_type"=>"fboxs", "_id"=>"AViE2ZLx_lz5mWQZHGac", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [geoip.latitude]", "caused_by"=>{"type"=>"number_format_exception", "reason"=>"For input string: "%{lat}""}}}}}"

How to fix it? Thanks.

[magnusbaeck (Magnus Bäck)]

As the error message shows, your [geoip][latitude] field doesn't contain the latitude but the string "%{lat}", indicating that the lat field was unset when your mutate filter ran. Is that filter outside the if [fields][Contract] =~ "HNH" conditional? Is that really correct?

[namcx]

Tks for reply.

This json input
{"received_at":"2016-11-09T08:04:59+07:00","message":"-","fields":{"Contract":"HNH004399"},"@version":"1","@timestamp":"2016-11-09T01:05:00.402Z","type":"fboxs","tags":["fboxs"],"host":"0.0.0.0","year":"2016","month":"11","day":"09","hour":"08","min":"04","min_5":0}

And if [fields][Contract] =~ "HNH" will add [city], [lon] and [lat]. So correctly?

Sorry my bad english.

[magnusbaeck (Magnus Bäck)]

And if [fields][Contract] =~ "HNH" will add [city], [lon] and [lat]. So correctly?

Yes.