Parsing an array of coordinate values

[waynesmallman]

Hi, we're attempting to parse coordinate data: "[33.5586, -112.0955]" but we don't know if it needs to be converted, and if so, what type should we use?

So far, we've tried string, but it's as if Logstash is attempting to parse it regardless:

[2018-09-07T08:13:48,565][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"correct_downloads_en_v1", :_type=>"correct_downloads", :_routing=>nil}, #<LogStash::Event:0x76b9b85c>], :response=>{"index"=>{"_index"=>"correct_downloads_en_v1", "_type"=>"correct_downloads", "_id"=>"m0rhsmUBxmfELKVANSDi", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse", "caused_by"=>{"type"=>"number_format_exception", "reason"=>"For input string: "[144.9522""}}}}}

In the ".conf" file, we have:

mutate {
	rename => {
		"keen_ip_geo.coordinates" => "[ip_geo][coordinates]"
	}
	convert => {
		"keen_ip_geo.coordinates" => "string"
	}
}

Is it possible there's a problem or conflict between the convert and the rename instructions?

[magnusbaeck (Magnus Bäck)]

You probably mean [keen_ip_geo][coordinates] and not keen_ip_geo.coordinates. But I'm not sure your configuration makes sense; if the rename operation is successful there won't be a field left to convert.