Mr. Lawson:
Sorry for your bad experience with the tutorial! With current versions of Elasticsearch, this dataset needs a geolocation mapping to work properly.
To clear the data from a previous import, execute the following commands:
curl -XDELETE http://localhost:9200/logstash-2015.05.18
curl -XDELETE http://localhost:9200/logstash-2015.05.19
curl -XDELETE http://localhost:9200/logstash-2015.05.20
Before importing the logs.jsonl file to Elasticsearch, establish the mappings with the following command:
curl -XPUT http://localhost:9200/logstash-2015.05.18 -d '
{
"mappings" : {
"log" : {
"properties" : {
"geo" : {
"properties" : {
"coordinates" : {
"type" : "geo_point"
}
}
}
}
}
}
}
';
Repeat that mapping for the other two dates, 2015-05-19 and 2015-05-20, then import logs.jsonl according to the tutorial's instructions.
You may need to refresh your indexes by navigating to Settings > Indices in the Kibana UI, selecting the logstash-*
index pattern, and clicking the yellow Refresh button.
I'll update the documentation to reflect this step soonest.
Paul Echeverri
Senior Technical Writer
(edit: corrected the mapping, added directions on clearing old indices)