Parsing an array of coordinate values

Elastic Stack Logstash
1

Hi, we're attempting to parse coordinate data: "[33.5586, -112.0955]" but we don't know if it needs to be converted, and if so, what type should we use?

So far, we've tried string, but it's as if Logstash is attempting to parse it regardless:

[2018-09-07T08:13:48,565][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"correct_downloads_en_v1", :_type=>"correct_downloads", :_routing=>nil}, #<LogStash::Event:0x76b9b85c>], :response=>{"index"=>{"_index"=>"correct_downloads_en_v1", "_type"=>"correct_downloads", "_id"=>"m0rhsmUBxmfELKVANSDi", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse", "caused_by"=>{"type"=>"number_format_exception", "reason"=>"For input string: "[144.9522""}}}}}

In the ".conf" file, we have:

mutate {
	rename => {
		"keen_ip_geo.coordinates" => "[ip_geo][coordinates]"
	}
	convert => {
		"keen_ip_geo.coordinates" => "string"
	}
}

Is it possible there's a problem or conflict between the convert and the rename instructions?

2

You probably mean [keen_ip_geo][coordinates] and not keen_ip_geo.coordinates. But I'm not sure your configuration makes sense; if the rename operation is successful there won't be a field left to convert.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.