Unable to load lat and lon values in map view

Elastic Stack Logstash
1

Hi
I am using kibana 5.6.3 and i am facing problem while creating coordinate map after loading index. I am getting error as

No Compatible Fields: The "geo4-*" index pattern does not contain any of the following field types: geo_point

i am having csv file with city, lat , long columns and values as below

city lat lon
London 51.5073509 -0.1277583

and i created logstash.conf as below

input {
file {
path => "D:\Projects\Level3-kibana\DataSet\Test.csv"
start_position => "beginning"
sincedb_path => "/dev/null"
}
}

filter {
csv {
separator => ","
columns => ["city","lat","lon"]

}

mutate {
convert => { "lat" => "float" }
convert => { "lon" => "float" }
add_field => {
"[geoip][location]" => [ "%{lon}", "%{lat}" ]
"[geoip][latitude]" => "%{lat}"
"[geoip][longitude]" => "%{lon}"
}
}

mutate {convert =>["city","string"]}

mutate {
remove_field => [ "message", "host", "@timestamp", "@version" ]
}
}

output {
elasticsearch {
hosts => "http://localhost:9200"
index => 'geo4-point'

}
stdout{}
}

can someone help me to load this coordinates in map

2

In Logstash's default index template the [geoip][location] field is mapped a geo_point field, but because you're naming your index geo4-point instead of something that matches logstash-* you won't get that mapping. Either change your index name or upload an index template that matches the indexes you're going to have.

1 Like
3

https://www.elastic.co/blog/geoip-in-the-elastic-stack has more on this problemn.

4

Ah, that was the blog post I was looking for.

5

Thanks magnusbaeck

i tried changing like this

output {
elasticsearch {
hosts => "http://localhost:9200"
index => 'testcormap-index'

}
stdout{}

}

but even facing the same error
No Compatible Fields: The "testcormap-*" index pattern does not contain any of the following field types: geo_point

6

testcormap-index also doesn't match the logstash-* pattern.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.