Logstash configuration geo_point mapping not apply

Elastic Stack Logstash
1

hi guys, I'm ELK 6.3.1 user.
I have question about geo_mapping in logstash.

I was using logstash .conf file for CSV file and Json template file. (was in 5.2.2)
Below is a part of configuration file.

input {
    file {
          path => "~/*.csv"
          start_position => "beginning"
          sincedb_path => "/dev/null"
    }
}

filter {
    csv {
              separator => ","
              columns => [~, "HV_Lat", "HV_Lon", ~]
              skip_empty_columns => true
              remove_field => [~]
              convert => {
                                     ~
                                     "HV_Lat" => "float"
                                     "HV_Lon" => "float"
                                     ~
                                  }
            }

              date {
                           match => []
                           target => []
                        }

               mutate { rename => {"HV_Lat" => "[location][lat]"}}
               mutate { rename => {"HV_Lat" => "[location][lon]"}}   
}

output {
       elasticsearch {
             hosts => "http://localhost:9000"
             index => "x10_2018"
             template=> "./template.json"
       }
        ~
}

my template file "template.json" is below.

{
    "mappings":
    {
	"*_2018":
	{
		"doc":
		{
		    "properties":
		    {
		         "location":
		        {
				"properties":
				{
					"lat":
					{
						"type": "float"
					},
					"location":
					{
						"type": "geo_point"
					},
					"lon":
					{
						"type": "float"
					}
				}
		        }
		    }
        }
	}
    }
}

When I was logstash processing configure file with json template, I can make index on Kibana, but cannot mapping geo_point.

How am I mapping geo_point use template file?

(not mapping geo_point result)

image
image.png713×747 72.6 KB

2

The full location field should be mapped as geo_point and you should not map the individual lat and lon fields:

{
...
  "doc": {
    "properties": {
      "location": {
        "type": "geo_point"
      }
    }
  }
...
}

You can see an example in this blog post.

3

I appreciate your reply Christian.

I did try it a few minutes before, but unfortunately still not mapping yet.

below is modified json

{
"mappings":
{
"*_2018":
{
"doc":
{
"properties":
{
"location":
{
"type": "geo_point"
}
}
}
}
}
}

below is same result about mapping failure

image
image588×714 42.6 KB

If you don't mine, could you tell me how to edit for geo_point mapping?..

4

As you can not change existing mappings you need to create a new index with the updated mapping. Did you do that? What is the current mapping for that field in the index?

5

In my case, deleted exist index (x10_2018) first.
next I did logstash again same index with upper template. (modified json)

however, I still saw geo_point mapping not completed.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.