Question

我使用logstash将地理空间数据从csv输入到elasticsearch作为geo_points。

CSV如下所示：

$ head -5 geo_data.csv
"lon","lat","lon2","lat2","d","i","approx_bearing"
-1.7841,50.7408,-1.7841,50.7408,0.982654,1,256.307
-1.7841,50.7408,-1.78411,50.7408,0.982654,1,256.307
-1.78411,50.7408,-1.78412,50.7408,0.982654,1,256.307
-1.78412,50.7408,-1.78413,50.7408,0.982654,1,256.307

我创建了一个如下所示的映射模板：

$ cat map_template.json

{
  "template": "base_map_template",
  "order":    1,
  "settings": {
    "number_of_shards": 1
  },
    {
      "mappings": {
        "base_map": {
          "properties": {
            "lon2": { "type" : "float" },
            "lat2": { "type" : "float" },
            "d": { "type" : "float" },
            "appox_bearing": { "type" : "float" },
            "location": { "type" : "geo_point" }
          }
        }
      }
    }
}

我的logstash配置文件已设置如下：

$ cat map.conf

input {
  stdin {}
}

filter {
  csv {
      columns => [
        "lon","lat","lon2","lat2","d","i","approx_bearing"
      ]
  }

  if [lon] == "lon" {
      drop { }
  } else {
      mutate {
          remove_field => [ "message", "host", "@timestamp", "@version" ]
      }

      mutate {
          convert => { "lon" => "float" }
          convert => { "lat" => "float" }
          convert => { "lon2" => "float" }
          convert => { "lat2" => "float" }
          convert => { "d" => "float" }
          convert => { "i" => "integer"}
          convert => { "approx_bearing" => "float"}
      }

      mutate {
          rename => {
              "lon" => "[location][lon]"
              "lat" => "[location][lat]"
          }
      }
  }
}

output {
#  stdout { codec => rubydebug }
  stdout { codec => dots }
  elasticsearch {
      index => "base_map"
      template => "map_template.json"
      document_type => "node_points"
      document_id => "%{i}"
  }
}

然后我尝试使用logstash使用以下命令将csv数据作为geo_points输入到elasticsearch中：

$ cat geo_data.csv | logstash-2.1.3/bin/logstash -f map.conf

我收到以下错误：

Settings: Default filter workers: 16
Unexpected character ('{' (code 123)): was expecting double-quote to start field name
at [Source: [B@278e55d1; line: 7, column: 3]{:class=>"LogStash::Json::ParserError", :level=>:error}
Logstash startup completed
....Logstash shutdown completed

我错过了什么？

Answer 1

任意“{”在模板文件的第7行

logstash和elasticsearch geo_point

1 个答案: