Replace LAT and LON values

Elastic Stack Logstash
1

my goal is to not plot the "dot" down to spcific state or city, just country.
Sample data:

"geoip" => {
          "latitude" => 44.6628,
          "location" => {
        "lon" => -93.1539,
        "lat" => 44.6628
    }

I want to replace with lon = -98.35 and lat = 39.50

I tried the following:

if [geoip][country_name] == "United States" {
mutate { replace => [ "[geoip][latitude][lat]", 39.50 ] }
mutate { replace => [ "[geoip][longitude][lon]",-98.35 ] }

mutate {
  convert => { "[geoip][longitude][lat]" => "float" }
  convert => { "[geoip][longitude][lon]" => "float" }
}

}

last error/exception i got is : [2019-09-25T13:04:45,361][WARN ][logstash.filters.mutate ] Exception caught while applying mutate filter {:exception=>"Could not set field 'lat' on object '41.2709' to value '39.50'.This is probably due to trying to set a field like [foo][bar] = someValuewhen [foo] is not either a map or a string"}

the same error for "lon"

how do i replace geoip.location with fix coordinates?

thanks,
Sirjune

2

[geoip][latitude] is a string, not an object, so it cannot have a [lat] field.

[geoip][longitude] does not exist. Did you mean [geoip][location]?

3

@Badger, grr! my bad! yah, i mean "geoip.location". Tired eyes :slight_smile:

should have been:
mutate { replace => [ "[geoip][location][lat]", 39.50 ] }
mutate { replace => [ "[geoip][location][lon]",-98.35 ] }

4

Does that mean the problem is fixed? Was the typo in the question or in the configuration?

5

@Badger, Yes the typo was the problem. And a little bit in the coordinates (minutes to decimal)

Thanks much again!
if [geoip][country_name] == "United States" {
mutate { replace => [ "[geoip][location][lat]", 39.833 ] }
mutate { replace => [ "[geoip][location][lon]",-98.583 ] }
mutate {
convert => { "[geoip][location][lat]" => "float" }
convert => { "[geoip][location][lon]" => "float" }
}