Ruby filter in logstash

Hi!

I have a list of geo_points coverage: [{"lon": *** , "lat": ***} , {"lon": ***, "lat": ***},...] in a field (coverage) but logstash reads them as text.

I put a new location (type geo_point) tremplate

	PUT logstash_h5
{
  "mappings": {
      "properties": {
        "location": {
          "type": "geo_point"
        }
      }
    }
}

and I would like to to convert all the geo_points of the text field to geo_points in the new location field.

I tried to do that with the following filter code but it doesn't work:

ruby{
	code => "
		event.get('[metas][dc:coverage]').each do |item|
			if item['lat']!=''
				event.set(item['lon'], '[location][lon]')
			end
			if item['lon']!=''
				event.set(item['lat'], '[location][lat]')
			end
		end
		"
    }

What is wrong please?
Thanks!

That appears to be the wrong way around . It probably sets item[lon] to nil, since that will not exist yet.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.