我正在尝试使用GEO位置点在Kibana上创建一个Tile地图。 出于某种原因,当我尝试创建地图时,我在Kibana上收到以下消息:
没有兼容字段:"记录"索引模式不包含任何 以下字段类型:geo_point
我的设置:
Logstash(版本2.3.1):
filter {
grok {
match => {
"message" => "MY PATTERN"
}
}
geoip {
source => "ip"
target => "geoip"
add_field => [ "location", "%{[geoip][latitude]}, %{[geoip][longitude]}" ] #added this extra field in case the nested field is the problem
}
}
output {
stdout { codec => rubydebug }
elasticsearch {
hosts => ["localhost:9200"]
index => "logs"
}
}
当日志输入到达时,我可以看到它按原样解析它,我确实得到给定IP的geoIp数据:
"geoip" => {
"ip" => "XXX.XXX.XXX.XXX",
"country_code2" => "XX",
"country_code3" => "XXX",
"country_name" => "XXXXXX",
"continent_code" => "XX",
"region_name" => "XX",
"city_name" => "XXXXX",
"latitude" => XX.0667,
"longitude" => XX.766699999999986,
"timezone" => "XXXXXX",
"real_region_name" => "XXXXXX",
"location" => [
[0] XX.766699999999986,
[1] XX.0667
]
},
"location" => "XX.0667, XX.766699999999986"
ElasticSearch(版本2.3.1):
GET / logs / _mapping返回:
{
"logs": {
"mappings": {
"logs": {
"properties": {
"@timestamp": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
},
.
.
.
"geoip": {
"properties": {
.
.
.
"latitude": {
"type": "double"
},
"location": {
"type": "geo_point"
},
"longitude": {
"type": "double"
}
}
},
"location": {
"type": "geo_point"
}
}
}
}
}
}
Kibana(4.5.0版):
我确实看到了所有的数据,一切似乎都很好。
就在我去" Visualize" - > "平铺地图" - > "从新搜索" - > " Geo Coordinates",我收到此错误消息:
No Compatible Fields: The "logs" index pattern does not contain any of the following field types: geo_point
即使我在elasticsearch mapping中看到位置类型是geo_point。 我错过了什么?
答案 0 :(得分:1)
发现问题! 我打电话给索引"记录"。将索引名称更改为" logstash-logs" (需要logstash- *前缀),一切都开始运作了!