Location type geo_point

Elastic Stack Logstash
1

Hi,

I am trying to create a map on my environment, but I am not able to create the field location type geo_point. I am using version 7.10.2

My logstash conf


 geoip {

  source => "ip_client"

}

mutate {

add_field => [ "[geoip][location]" , "%{longitude}" ]

add_field => [ "[geoip][location]" , "%{latitude}" ]

}

My template


{

  "index_templates" : [

    {

      "name" : "big_ip",

      "index_template" : {

        "index_patterns" : [

          "big_ip-waf-logs-*"

        ],

        "template" : {

          "settings" : {

            "index" : {

              "number_of_shards" : "1"

            }

          },

          "mappings" : {

            "properties" : {

              "location" : {

                "type" : "geo_point"

              }

            }

          },

          "aliases" : {

            "mydata" : { }

          }

        },

        "composed_of" : [ ],

        "priority" : 200,

        "version" : 3,

        "_meta" : {

          "description" : "Big IP WAF"

        }

      }

    }

  ]

}

##The error:


[2021-01-25T06:11:02,319][WARN ][logstash.outputs.elasticsearch][main][ebd65197aef2322dde6d849c25af897d96eba0752661fccf151896a01975c723] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"big_ip-waf-logs-2021.01.25", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0x3df7f5a7>], :response=>{"index"=>{"_index"=>"big_ip-waf-logs-2021.01.25", "_type"=>"_doc", "_id"=>"zUAqOHcBdgZ1N8nvwsIf", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [geoip.location] cannot be changed from type [float] to [text]"}}}}

{
2

Welcome to our community! :smiley:

You shouldn't need to do this if the geoip filter is working properly.

Though that would suggest that the filter is not working for some reason.

Can you post one of the events that is in Elasticsearch that Logstash has processed?

3

Hi,

I solved the problem by changing my template:

PUT _index_template/test
{
  "index_patterns": ["test**"],
  "template": {
    "settings": {
      "number_of_shards": 1
    },
  "mappings": {
  "properties": {
     "geoip": {
        "dynamic": true,
    "properties": {
      "ip": {
            "type": "ip"
          },
          "latitude": {
            "type": "half_float"
          },
          "location": {
            "type": "geo_point"
          },
          "longitude": {
            "type": "half_float"
          }
        }
      }
  },
    "aliases": {
      "mydata": { }
    }
  },
  "priority": 200,
  "version": 3,
  "_meta": {
    "description": "Test"
  }

My logstash file:


 geoip {

  source => "ip_client"

}
1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.