No. As I read again the documentation for logstash and read a forum (Add Geopoint based off of parsed value to logstash config) I copied the logstash elasticsearch output plugin template and attempted to modify it for my needs.
Here is my template:
{
"template" : "myproject-*",
"settings" : {
"index.refresh_interval" : "5s"
},
"mappings" : {
"_default_" : {
"_all" : {"enabled" : true, "omit_norms" : true},
"dynamic_templates" : [ {
"message_field" : {
"match" : "message",
"match_mapping_type" : "string",
"mapping" : {
"type" : "string", "index" : "analyzed", "omit_norms" : true,
"fielddata" : { "format" : "disabled" }
}
}
}, {
"string_fields" : {
"match" : "*",
"match_mapping_type" : "string",
"mapping" : {
"type" : "string", "index" : "analyzed", "omit_norms" : true,
"fielddata" : { "format" : "disabled" },
"fields" : {
"raw" : {"type": "string", "index" : "not_analyzed", "ignore_above" : 256}
}
}
}
} ],
"properties" : {
"@timestamp": { "type": "date" },
"@version": { "type": "string", "index": "not_analyzed" },
"geoip" : {
"dynamic": true,
"properties" : {
"ip": { "type": "ip" },
"location" : { "type" : "geo_point" },
"latitude" : { "type" : "float" },
"longitude" : { "type" : "float" }
}
},
"location" : { "type": "geo_point" }
}
}
}
}
When I look at the geo point documentation (https://www.elastic.co/guide/en/elasticsearch/reference/current/geo-point.html) is see that the json for the commands to set a geo point appear different than what I see in my output. I see:
"location": {
"lat": 33.48414869262067,
"lon": -81.8800662624854
}
when the examples seem to have extra curly braces:
{
"location": {
"lat": 33.48414869262067,
"lon": -81.8800662624854
}
}
Do the extra braces matter?