# Logstash - line string - Geoshape
**URL:** https://discuss.elastic.co/t/logstash-line-string-geoshape/184585
**Category:** Logstash
**Created:** [June 6, 2019, 12:59pm UTC](https://discuss.elastic.co/t/logstash-line-string-geoshape/184585 "2019-06-06T12:59:46Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)
#### Post date: [June 6, 2019, 12:59pm UTC](https://discuss.elastic.co/t/logstash-line-string-geoshape/184585/1 "2019-06-06T12:59:46Z")
Hi There,
Could anyone help me to add a new field called geolocalisation which includes source and destination coordinates .
like
"coordinates" : [[-77.03653, 38.897676], [-77.009051, 38.889939]]
Write now I use this filter to have separately source and destination and now I want to combine both source coordinates and destination coordinates in a single field
filter {
if [type] == "netflow\_cisco" {
geoip {
source =\> "[netflow][ipv4\_src\_addr]"
target =\> "src\_geoip"
add\_field =\> ["[geoip][coordinates]", "%{[src\_geoip][latitude]}" ]
add\_field =\> ["[geoip][coordinates]", "%{[src\_geoip][longitude]}" ]
periodic\_flush =\> "true"
}
geoip {
source =\> "[netflow][ipv4\_dst\_addr]"
target =\> "dst\_geoip"
add\_field =\> ["[geoip][coordinates]", "%{[dst\_geoip][latitude]}" ]
add\_field =\> ["[geoip][coordinates]", "%{[dst\_geoip][longitude]}" ]
periodic\_flush =\> "true"
}
mutate {
convert =\> ["[geoip][coordinates]", "float"]
}
}
}
Thanks,
Raj
---
### Author:  [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)
#### Post date: [June 11, 2019, 10:25am UTC](https://discuss.elastic.co/t/logstash-line-string-geoshape/184585/2 "2019-06-11T10:25:08Z")
Any help please ?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 11, 2019, 2:09pm UTC](https://discuss.elastic.co/t/logstash-line-string-geoshape/184585/3 "2019-06-11T14:09:09Z")
Does [this](https://discuss.elastic.co/t/geo-shape-geo-link-problems-with-coordinates/179924/6) help?
---
### Author:  [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)
#### Post date: [June 12, 2019, 7:49am UTC](https://discuss.elastic.co/t/logstash-line-string-geoshape/184585/4 "2019-06-12T07:49:26Z")
Thank your help and reply, sorry if my question is silly.Actually am using this geo coordinate fro my netflow traffic ,in that case how to use a specific coordinates as you have specified (-87.623171, 41.881832), because i was confused in netflow traffic i could see multiple coordinates (source and destination)
```
mutate {
add_field => {
"[geo_link][type]" => "linestring"
}
}
ruby {
code => '
event.set("[geo_link][coordinates]", [[-87.623171, 41.881832], [-87.623177, 41.881833]])
'
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 12, 2019, 1:04pm UTC](https://discuss.elastic.co/t/logstash-line-string-geoshape/184585/5 "2019-06-12T13:04:09Z")
How about
```
ruby {
code => 'event.set("[geoip][coordinates]", [event.get("[src_geoip][latitude]"), event.get("[src_geoip][longitude]") ] )'
}
```
---
### Author:  [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)
#### Post date: [June 13, 2019, 9:34am UTC](https://discuss.elastic.co/t/logstash-line-string-geoshape/184585/6 "2019-06-13T09:34:59Z")
thank you for the reply but i would like to include both source and destination in same field, how to do it like
"geolocalisation" : "[[53.3338,-6.2488], [55.6572,12.4736]]",
something like this
[[{{src\_geoip.latitude}},{{src\_geoip.longitude}}], [{{dst\_geoip.latitude}},{{dst\_geoip.longitude}}]]"
but i dont know how to put it in ruby
What am trying to achieve - is to make line string type with geo shape for this field geolocalisation
---
### Author:  [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)
#### Post date: [June 13, 2019, 1:03pm UTC](https://discuss.elastic.co/t/logstash-line-string-geoshape/184585/7 "2019-06-13T13:03:00Z")
Hi Badger ,
I Tried like this
filter {
if [type] == "netflow\_cisco" {
mutate {
add\_field =\> {
"[geo\_link][type]" =\> "linestring"
}
}
ruby {
code =\> 'event.set("[geoip][coordinates]", [[event.get("[src\_geoip][latitude]"), event.get("[src\_geoip][longitude]") ],[event.get("[dst\_geoip][latitude]"), event.get("[dst\_geoip][longitude]") ]] )'
}
}
}
I get error like this
[WARN] 2019-06-13 15:00:20.309 [[main]\>worker1] elasticsearch - Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"logstash\_netflow-2019.06.13", :\_type=\>"\_doc", :routing=\>nil}, #LogStash::Event:0xd5fa261], :response=\>{"index"=\>{"\_index"=\>"logstash\_netflow-2019.06.13", "\_type"=\>"\_doc", "\_id"=\>"R\_XsUGsBik9o9Vi0uyTI", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse field [geo\_link] of type [text] in document with id 'R\_XsUGsBik9o9Vi0uyTI'", "caused\_by"=\>{"type"=\>"illegal\_state\_exception", "reason"=\>"Can't get text on a START\_OBJECT at 1:103"}}}}}
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 13, 2019, 3:43pm UTC](https://discuss.elastic.co/t/logstash-line-string-geoshape/184585/8 "2019-06-13T15:43:28Z")
> [@Raj\_Kumar](#):
>
> reason"=\>"Can't get text on a START\_OBJECT at 1:103"
I would expect the elasticsearch logs to have a more informative error message.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 11, 2019, 3:43pm UTC](https://discuss.elastic.co/t/logstash-line-string-geoshape/184585/9 "2019-07-11T15:43:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.