Logstash - template/index issue


(Ravi Gude) #1

Before loading my data, I checked that my index (securedapachelogs) or template ( sc_apache_template) in elasticsearch. both do not exist. Logstash is going to request that template/index were created on startup.
Once the data was loaded ( no errors in logstash ), elasticsearch _mapping for the index still shows location field type as float instead of geo_point. I do see all the geo fields populated. Hence I am not able to use location field on tile chart. I need help on how I can force elasticsearch to use only the index template I have provided in logstash config file.
I tried options template_overwrite and managed_template.

The following url has the template, conf file, sample log, grok pattern

http://pastebin.com/7PqtJWtz


(Magnus B├Ąck) #2

What does the Logstash log say? Does it indicate that it's trying to post the index template? You may have to increase the logging verbosity.


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.