Mapping for geo_point-usage not working with twitter input

Elastic Stack Logstash
1

Hi guys,

i set up elasticsearch with kibana and logstash and i would like to analyze some Tweets with it.

Currently my configuration looks like this:

    input {
  twitter {
    consumer_key        => mykey
    consumer_secret     => mysecret
    keywords            => ["#weather"]
    oauth_token         => "mytoken"
    oauth_token_secret  => "mytokensecret"
    full_tweet          => true
  }
}

output {
  elasticsearch {
    host  => localhost
    index => "twitter-weather"
    document_type => "tweet"
    template => "twitter_template.json"
    template_name => "twitter"
  }
}

and my twitter_template looks like this:

    {
  "template": "twitter",
  "order":    1,
  "settings": {
    "number_of_shards": 1
  },
  "mappings": {
    "tweet": {
      "_all": {
        "enabled": false
      },
      "dynamic_templates" : [ {
         "message_field" : {
           "match" : "message",
           "match_mapping_type" : "string",
           "mapping" : {
             "type" : "string", "index" : "analyzed", "omit_norms" : true
           }
         }
       }, {
         "string_fields" : {
           "match" : "*",
           "match_mapping_type" : "string",
           "mapping" : {
             "type" : "string", "index" : "analyzed", "omit_norms" : true,
               "fields" : {
                 "raw" : {"type": "string", "index" : "not_analyzed", "ignore_above" : 256}
               }
           }
         }
       } ],
      "properties": {
        "text": {
          "type": "string"
        },
        "coordinates": {
          "type": "string"
          "properties": {
            "coordinates": {
              "type": "geo_point"
            }
          }
        }
      },
      "properties": {
        "text": {
          "type": "string"
        },
        "geo": {
          "properties": {
            "type": "string"
          },
          "coordinates": {
            "type": "geo_point"
          }
        }
      }
    }
  }
}

The coordinates are located as array in coordinates.coordinates

Example:

   "geo": {
  "type": "Point",
  "coordinates": [
    29.875016,
    -92.218675
  ]
},
"coordinates": {
  "type": "Point",
  "coordinates": [
    -92.218675,
    29.875016
  ]
},

Anyway i can't use them with a pile map.

Can anyone help me? I would appreciate every help! :smile:

Sincerely yours
Dominik Müller

2

having same issue here... working on that. did you solve it?

==== I just solved it!

try creating a new template changing the mapping to geoip_point

in /etc/logstash/conf.d/twitter.conf

    manage_template => true
    template => "/etc/logstash/templates/twitter_template.json"
    template_name => "twd"

in twitter_template.json :

"properties" : {
"@version": { "type": "string", "index": "not_analyzed" },
"coordinates" : {
"type" : "object",
"dynamic": true,
"properties" : {
"coordinates" : { "type" : "geo_point" }
}

use the elastisearch-template.json as a base.