[SOLVED] Geoip.location doesn't work anymore after upgrade to 5.0


(Catalin Tileaga) #1

I have two float fields: valueLatitude and valueLongitude and try to send them to elasticsearch as geoip.location. In logstash configuration I have this:

        mutate {
            add_field => [ "[location]", "%{valueLongitude}" ]
            add_field => [ "[location]", "%{valueLatitude}" ]
        }

        mutate {
            rename => [ "[location]", "[geoip][location]" ]
            remove_field => [ "valueLatitude", "valueLongitude" ]
        }

It worked before 5.0 without problems. Now I get a strange error:

illegal latitude value [268.52273331955075] for geoip.location. 

The strange fact is that the latitude from the log file is: 47.279341

Did the format was changed?


(Catalin Tileaga) #2

Or, how can I do that in 5.0, maybe there is another solution.

The use case is: I have two floats (latitude and longitude) and want to show them on a map in Kibana.


(Catalin Tileaga) #3

I solved the problem. So if someone has the same use case this is the configuration part to do it:

mutate {
            add_field => [ "[location]", "%{valueLongitude}" ]
            add_field => [ "[location]", "%{valueLatitude}" ]
        }

        mutate {
            rename => [ "[location]", "[geoip][location]" ]
            remove_field => [ "valueLatitude", "valueLongitude" ]
           convert => [ "[geoip][location]", "float" ]
        }

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.