How to create map based on longitude, latitude fileds?

(NamCx) #1

Hi Experts,

I had add 2 field with name lat,lon and value 21.033333, 105.849998 to index by logstash filter plugin "mutate"
if [fields][Contract] =~ "HNH" {
mutate {
add_field => [ "city", "Hanoi" ]
add_field => [ "lat", 21.033333 ]
add_field => [ "lon", 105.849998 ]
Then, i convert lat, lon to "float"
mutate {
convert => {
"lat" => "float"
"lon" => "float"
add_field => {
"[geoip][location]" => [ "%{lon}", "%{lat}" ]
"[geoip][latitude]" => "%{lat}"
"[geoip][longitude]" => "%{lon}"


But when start logstash, logstash show errror: "[2016-11-21T10:06:41,507][WARN ][logstash.outputs.elasticsearch] Failed action. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-test", :_type=>"fboxs", :_routing=>nil}, 2016-11-09T01:00:24.670Z -], :response=>{"index"=>{"_index"=>"logstash-test", "_type"=>"fboxs", "_id"=>"AViE2ZLx_lz5mWQZHGac", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [geoip.latitude]", "caused_by"=>{"type"=>"number_format_exception", "reason"=>"For input string: "%{lat}""}}}}}"

How to fix it? Thanks.

(Magnus Bäck) #2

As the error message shows, your [geoip][latitude] field doesn't contain the latitude but the string "%{lat}", indicating that the lat field was unset when your mutate filter ran. Is that filter outside the if [fields][Contract] =~ "HNH" conditional? Is that really correct?

(NamCx) #3

Tks for reply.

This json input

And if [fields][Contract] =~ "HNH" will add [city], [lon] and [lat]. So correctly?

Sorry my bad english.

(Magnus Bäck) #4

And if [fields][Contract] =~ "HNH" will add [city], [lon] and [lat]. So correctly?


(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.