Hi! Im trying to load tweets directly into elasticsearch 5.2.1 via logstash. If I'm just running the logstash file before setting up my mapping, all fields except geoloca with the type geo_point are fine. Therefore I am placing a mapping like this before to set type of geoloca:
PUT twitter
{
"mappings": {
"tweet": {
"_all": { "enabled": false },
"properties": {
"twitter_text": { "type": "string", "fielddata": true },
"hashtags": { "type": "string", "fielddata": true },
"user": { "type": "string" },
"country": { "type": "string" },
"geoloca": { "type": "geo_point" }
} } } }
And this is my logstash conf file.
input {
file {
path => "/root/Twitter/dataES.csv"
start_position => "beginning"
sincedb_path => "/dev/null"
}
}
filter {
csv {
columns => ['logtime', 'twitter_text', 'hashtags', 'user', 'country', 'longitude', 'latitude']
separator => ","
}
date {
match => ["logtime", "yyyy-MM-dd HH:mm:ss"]
timezone => "Europe/London"
target => "time"
}
mutate { convert => {"latitude" => "float"} }
mutate { convert => {"longitude" => "float"} }
mutate { rename => {"latitude" => "[geoloca][lat]"} }
mutate { rename => {"longitude" => "[geoloca][lon]"} }
mutate { remove_field => [ "message", "host", "@version", "path", "tags", "column6", "logtime"]}
}
output {
elasticsearch {
hosts => ["*******:9200"]
index => "twitter"
}
}
From the logfile, the error I can read is
"type"=>"illegal_argument_exception", "reason"=>"[geoloca] is defined as an object in mapping [logs] but this name is already used for a field in other types"
What is the problem? I really can't figure out whats wrong.