# Logstash parse multiple lat lon values

**URL:** <https://discuss.elastic.co/t/logstash-parse-multiple-lat-lon-values/298711>\
**Category:** Elasticsearch\
**Created:** [March 3, 2022, 8:11am UTC](https://discuss.elastic.co/t/logstash-parse-multiple-lat-lon-values/298711 "2022-03-03T08:11:01Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sylar11](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sylar11/32/102086_2.png) [@sylar11](https://discuss.elastic.co/u/sylar11)\
**Post date:** [March 3, 2022, 8:11am UTC](https://discuss.elastic.co/t/logstash-parse-multiple-lat-lon-values/298711/1 "2022-03-03T08:11:01Z")

</div>

Hi all,  
I have the following json file:

```auto
{
    "station": "A001",
    "X": 503744.7,
    "Y": 4726339.0,
    "Z": 458.84,
    "LON": -2.954286956913572,
    "LAT": 42.68952475979137,
    "dates": [
        "2015-01-01",
        "2015-01-02",
        "2015-01-03",
        "2015-01-04",
        "2015-01-05",
        "2015-01-06"
    ],
    "values": [
        "56.9",
        "49.7",
        "48.1",
        "37.1",
        "34.4",
        "35.9"
    ]
}{
    "station": "A002",
    "X": 607870.5,
    "Y": 4670754.0,
    "Z": 264.83,
    "LON": -1.69378623727067,
    "LAT": 42.18149989583031,
    "dates": [
        "2015-01-01",
        "2015-01-02",
        "2015-01-03",
        "2015-01-04"
    ],
    "values": [
        "287",
        "231",
        "207",
        "191"
    ]
}{
    "station": "A403",
    "X": 868708.0,
    "Y": 4709148.0,
    "Z": 849.0,
    "LON": 1.483146867002623,
    "LAT": 42.44694604132231,
    "dates": [
        "2015-01-01",
        "2015-01-02",
        "2015-01-03",
        "2015-01-04",
        "2015-01-05",
        "2015-01-06",
        "2015-01-07",
        "2015-01-08",
        "2015-01-09"
    ],
    "values": [
        "2.296",
        "7.033",
        "2.298",
        "2.275",
        "7.207",
        "5.456",
        "4.794",
        "4.24",
        "4.748"
    ]
}

```

I would like to extract all the lat lon values for each station to be then imported in KIBANA.

I have created the following conf file for logstash:

```auto
input {
    file {
        path => "/etc/logstash/json_data.json"
        sincedb_path => "/dev/null"
        start_position => "beginning"
        codec => multiline {
            pattern => "^Not_exists"
            negate => "true"
            what => "previous"
            auto_flush_interval => 1
            multiline_tag => ""
        }
    }
}
filter {
    json {
        source => "message"
        remove_field => ["message"]
        remove_field => ["original"]
    }
              mutate {
            rename => {
                "LON" => "[locations][lon]"
                "LAT" => "[locations][lat]"
    }
         remove_field => ["LAT", "LON"]
 }
}

output {
        elasticsearch {
            hosts => ["https://myIP:9200"]
            user => "elastic"
            password => "mypaswd"
            ssl_certificate_verification => false
            index => "test_geo_data_json"
            document_type => "json"
        }
        stdout {codec => rubydebug}
   }

```

What I'm getting is that logstash is reading only one station (the last one) and only its corresponding geopoint is created.

Could you please tell me what I'm doing wrong?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 31, 2022, 8:11am UTC](https://discuss.elastic.co/t/logstash-parse-multiple-lat-lon-values/298711/2 "2022-03-31T08:11:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.