I'm trying to set the envelope geo shape, but cant get the array of array right. It should be: [[a,b],[c,d]]. I know the syntax is wrong but not sure what to change. Tried both ways using ruby and mutate.
Error
"Failed to build [geojson] after last required field arrived","caused_by":{"type":"null_pointer_exception"}
mutate {
add_field => {
"[geo][geobound][type]" => "envelope"
"[geo][geobound][coordinates]" => [["%{[geo][minlon]}","%{[geo[maxlat]}"], ["%{[geo][maxlon]}","%{[geo][minlat]}"]]
}}
output
"geo" => {
"geobound" => {
" type" => "envelope",
"coordinates" => [
[0] 0.0,
[1] 0.0
]
}
}
Using ruby (if i use the outer brackets like [[a,b],[c,d]] then its erroring as a code format issue. so tried it without the outer bracket).
Error: Failed to parse field [coordinates]","caused_by":{"type":"parse_exception","reason":"geo coordinates greater than 3 dimensions are not supported"}
mutate {
add_field => {"[geo][geobound][type]" => "envelope"}
}
ruby {
code => '
event.set("[geo][geobound][coordinates]", ["%{[geo][minlon]}","%{[geo][maxlat]}","%{[geo][maxlon]}","%{[geo][minlat]}"])
'
}
output
"geo" => {
"geobound" => {
" type" => "envelope",
"coordinates" => [
[0] 0.0,
[1] 0.0,
[2] 0.0,
[3] 0.0
]
} }