Mapping field to geoip.location throws parsing exception


(Cannibalcow) #1

Hi

I use the jdbc input plugin to fetch my data. It contains a couple of columns with log data.
One of the columns contains latitue,longitude values.

I thought I could use the the 'geoip.location' field and then visualize it in kibanas tile map.

input {
    jdbc {
        jdbc_connection_string => "jdbc:oracle:thin:@database:1521:sche"
        jdbc_user => "user"
        jdbc_password => "password"
        jdbc_driver_library => "/opt/driver/ojdbc-11.1.0.7.0-jdk16.jar"
        jdbc_driver_class => "Java::oracle.jdbc.driver.OracleDriver"
        statement => "SELECT * FROM app_log"
        }
}

filter {
    mutate {
        rename => { "position" => "geoip.location" }
    }
}

output {
    elasticsearch {
        index => "logstash-test-%{+YYYY.MM.dd}"
        hosts =>  ["localhost"]
    }
     stdout { codec => json_lines }
}

When I run logstash I get this:

"error"=>{"type"=>"mapper_parsing_exception", "reason"=>"Field name [geoip.location] cannot contain '.'"}}}

The format of the field is (without the quotes):"66.86573948833629, 19.818217948317095"


(system) #2