Ruby filter in logstash


I have a list of geo_points coverage: [{"lon": *** , "lat": ***} , {"lon": ***, "lat": ***},...] in a field (coverage) but logstash reads them as text.

I put a new location (type geo_point) tremplate

	PUT logstash_h5
  "mappings": {
      "properties": {
        "location": {
          "type": "geo_point"

and I would like to to convert all the geo_points of the text field to geo_points in the new location field.

I tried to do that with the following filter code but it doesn't work:

	code => "
		event.get('[metas][dc:coverage]').each do |item|
			if item['lat']!=''
				event.set(item['lon'], '[location][lon]')
			if item['lon']!=''
				event.set(item['lat'], '[location][lat]')

What is wrong please?

That appears to be the wrong way around . It probably sets item[lon] to nil, since that will not exist yet.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.