Latitude and Longitude Error in logstash?

Elastic Stack Logstash
1

Hello Everyone,

I am trying to convert PostalCode to lat and long, I have done this task but Now I am confuse how to convert it into geopoint field

I have tried in logstash but no success so for, getting error.
My config file:

mutate {
        add_field => ["[location]", "%{lat}"]
        add_field => ["[location]", "%{lon}"]
}
mutate{
        convert => ["[location]", "float"]
    }

Output Looks Like:

 "location" => [
        [0] 61.9814,
        [1] -132.4242
    ],

Error I am getting in logstash:

 Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, 
:_index=>"caary_time_test", :routing=>nil, :_type=>"_doc"}, #
<LogStash::Event:0x1537f1d7>], :response=>{"index"=>{"_index"=>"caary_time_test", 
"_type"=>"_doc", "_id"=>"O8sRQ34BZIkRPQRnvuZL", "status"=>400, "error"=>
{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [lon] of type 
[geo_point]", "caused_by"=>{"type"=>"parse_exception", "reason"=>"unsupported 
symbol [-] in geohash [-132.4242]", "caused_by"=>{"type"=>"illegal_argument_exception",
 "reason"=>"unsupported symbol [-] in geohash [-132.4242]"}}}}}}
2

Try reversing your add_field order.

If you look at the examples Lat always becomes before Long except when you have it as an array. I don't know why.

mutate {
        add_field => ["[location]", "%{lon}"]
        add_field => ["[location]", "%{lat}"]
}
3

I have tried that way also but getting no success.

4

I think it is not meeting the requirement of geopoint datatypes.

5

What does your mapping look like? This works if you run it in Dev Tools.

PUT test-geo
{
  "mappings": {
    "properties": {
      "location": {
        "type": "geo_point"
      }
    }
  }
}

PUT test-geo/_doc
{
  "location": [ -132.4242, 61.9814 ]
}
6

It works fine, Actually I am getting postalCodes in incoming file then converting that postalCodes to latitude and longitude. Now I am facing problem how to convert lat and lon to geopoints.

7

How I can get such type of format in logstash to map geopoints.

8

Should be from what I posted above.

mutate {
        add_field => ["[location]", "%{lon}"]
        add_field => ["[location]", "%{lat}"]
}
9

lon and lat are in float or string?

10

There are a handful ways to format a geo_point. I usually just choose this method so you don't need to mess with arrays or data types.

Conf

input {
  generator {
    message => '[{ "lat": "61.9814", "lon":"-132.4242" }]'
    count => 1
    codec => "json"
  }
}
filter {
  mutate {
   add_field => ["[location]", "%{lat},%{lon}"]
  }
}
output {
  stdout { codec =>  "json" }
}

Output

"location": "61.9814,-132.4242"
11

It does not matter. To get a geo_point in elasticsearch you must have a mapping that says the field is a geo_point. Once you have that elasticsearch will parse anything like

"location": "41.12,-71.34"
"location": "drm3btev3e86"
"location": [ -71.34, 41.12 ] ,
"location" : "POINT (-71.34 41.12)"

and probably some others.

12

@aaron-nimocks Thanks Dear for your cooperation.

13

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.