# Logstash grok/mutate question
**URL:** https://discuss.elastic.co/t/logstash-grok-mutate-question/164200
**Category:** Logstash
**Created:** [January 14, 2019, 9:21pm UTC](https://discuss.elastic.co/t/logstash-grok-mutate-question/164200 "2019-01-14T21:21:43Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@alexevon](https://discuss.elastic.co/u/alexevon)
#### Post date: [January 14, 2019, 9:21pm UTC](https://discuss.elastic.co/t/logstash-grok-mutate-question/164200/1 "2019-01-14T21:21:44Z")
Hi all-
I have a fairly simple question which I hope not too many asked about:
I have a sample JSON stream from kafka into logstash that looks like this example data:
{
"\_index": "kafka\_logstash",
"\_type": "doc",
"\_id": "bGM6TmgBaUYXOpKs-Wzc",
"\_version": 1,
"\_score": null,
"\_source": {
"type": "kafkaconsumer",
"@timestamp": "2019-01-14T21:18:30.693Z",
"payload": {
"idinstance\_locations": 56275,
"longitude": 110,
"modified\_date": 1547482708000,
"heading": null,
"unique\_id": "3df33695-1322-47b0-abb9-b9182f05cc92",
"latitude": 32,
"device\_id": "TestData 5",
"altitude": 999.999,
"speed": null,
"created\_date": 1547482708000
}
},
What I wanted to do is just to extract the longitude and latitude from the above and populate them into the location geo-point field...
Is there an mutate/grok filter that can facilitate this?
Thank you!
Alex
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 14, 2019, 9:53pm UTC](https://discuss.elastic.co/t/logstash-grok-mutate-question/164200/2 "2019-01-14T21:53:35Z")
You can use mutate
```
mutate{
rename=>["latitude","location[lat]"]
rename=>["longitude","location[lon]"]
}
```
The harder part is making sure your index template establishes a mapping that causes location to be a geo\_point. [This](https://discuss.elastic.co/t/location-dosent-convert-to-geo-point/131199/4?u=badger) thread might help you with that.
---
### Author:  [@alexevon](https://discuss.elastic.co/u/alexevon)
#### Post date: [January 15, 2019, 2:44am UTC](https://discuss.elastic.co/t/logstash-grok-mutate-question/164200/3 "2019-01-15T02:44:05Z")
Thank you @Badger for the reply. I added your suggestions to the log.conf file and restarted logstash, but I did not see any changes. log.conf:
filter {
mutate{
rename=\>["latitude","location[lat]"]
rename=\>["longitude","location[lon]"]
}
}
I added the geo-point as suggested as well:
{
"mapping": {
"doc": {
"properties": {
"@timestamp": {
"type": "date"
},
"location": {
"type": "geo\_point"
},
Is there another mapping perhaps I am missing?
Thank you again!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 15, 2019, 1:16pm UTC](https://discuss.elastic.co/t/logstash-grok-mutate-question/164200/4 "2019-01-15T13:16:09Z")
Do 'GET \_template/yourIndexName'. Do you see a geo\_point mapping for location?
---
### Author:  [@alexevon](https://discuss.elastic.co/u/alexevon)
#### Post date: [January 15, 2019, 1:48pm UTC](https://discuss.elastic.co/t/logstash-grok-mutate-question/164200/5 "2019-01-15T13:48:35Z")
I do not actually: syntax: curl -sX GET [http://localhost:9200/\_template/kafka\_logstash](http://localhost:9200/_template/kafka_logstash)
..and the response:
{}
However, here is my index mapping per elastic:
{
"mapping": {
"doc": {
"properties": {
"@timestamp": {
"type": "date"
},
"location": {
"type": "geo\_point"
},
"payload": {
"properties": {
"altitude": {
"type": "float"
},
"created\_date": {
"type": "long"
},
"device\_id": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore\_above": 256
}
}
},
"idinstance\_locations": {
"type": "long"
},
"latitude": {
"type": "float"
},
"longitude": {
"type": "float"
},
"modified\_date": {
"type": "long"
},
"unique\_id": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore\_above": 256
}
}
}
}
},
"tags": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore\_above": 256
}
}
},
"type": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore\_above": 256
}
}
}
}
}
}
}
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 15, 2019, 1:56pm UTC](https://discuss.elastic.co/t/logstash-grok-mutate-question/164200/6 "2019-01-15T13:56:53Z")
Not sure. You might want to ask about the mapping in the elasticsearch forum.
---
### Author:  [@alexevon](https://discuss.elastic.co/u/alexevon)
#### Post date: [January 15, 2019, 2:19pm UTC](https://discuss.elastic.co/t/logstash-grok-mutate-question/164200/7 "2019-01-15T14:19:09Z")
Thank you @Badger
Alex
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 12, 2019, 2:19pm UTC](https://discuss.elastic.co/t/logstash-grok-mutate-question/164200/8 "2019-02-12T14:19:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.