使用kibi在瓷砖地图中显示位置点

Question

我使用的是logstash 2.3.1，elasticsearch 2.3.1和kibi 0.3.2。我在使用kibi可视化地图中的位置时遇到问题。

我在logstash中有以下配置：

input {  
    file {
        path => "/opt/logstash-2.3.1/logTest/Dades.csv"
        type => "Dades"
        start_position => "beginning"
    }
}

filter {  
    csv {
        columns => ["c1", "c2", "c3", "c4", "c5", "c6", "c7", "c8", "c9", "c10", "c11", "c12", "c13", "c14", "c15", "c16", "c17", "c18", "c19", "c20", "c21", "c22", "c23"]
        separator => ";"
    }

ruby {
        code => "
                temp = event['c17']
        event['c17'] = temp[0..1].to_f+ (temp[2..8].to_f/60)
        temp = event['c19']
        event['c19'] = temp[0..2].to_f+ (temp[3..8].to_f/60)

        "
    }

        mutate {
            convert => { 
            "c3" => "float"
            "c5" => "float"
            "c7" => "float"
            "c9" => "float"
            "c11" => "float"
            "c13" => "float"
            "c15" => "float"
            "c21" => "float"
            "c23" => "float"
        }

    }

    date { 
        match => [ "c1", "dd/MM/YYYY HH:mm:ss.SSS", "ISO8601"]
            target => "ts_date"
    }


    mutate {
            rename => [ "c17", "[location][lat]", 
            "c19", "[location][lon]" ]
    }
}


output {
    elasticsearch { 
        hosts => localhost
        index => "tram3"
        manage_template => false
        template => "tram3_template.json"
        template_name => "tram3"
         template_overwrite => "true"
    }
    stdout {
        codec => rubydebug
    }
}

映射配置文件（tram3_template.json）是这样的：

{
  "template": "tram3",
  "order":    1,
  "settings": {
    "number_of_shards": 1
  },
  "mappings": {
    "tram3": {
      "_all": {
        "enabled": false
      },
      "properties": {
          "location": {
            "type": "geo_point"
        }
      }
    }
  }
}

当我将de csv文件导入elasticsearch时，似乎一切正常。输出是这样的：

{
       "message" => "26/02/2016 00:00:22.984;Total;4231.143555;Trac1;26.547932;Trac2;-338.939697;AA1;-364.611511;AA2;3968.135010;Reo1;0.000000;Reo2;0.000000;Latitud;4125.1846;Longitud;00213.5219;Speed;0.000000;CVS;3873.429443;\r",
      "@version" => "1",
    "@timestamp" => "2016-04-25T14:02:52.901Z",
          "path" => "/opt/logstash-2.3.1/logTest/Dades.csv",
          "host" => "ubuntu",
          "type" => "Dades",
            "c1" => "26/02/2016 00:00:22.984",
            "c2" => "Total",
            "c3" => 4231.143555,
            "c4" => "Trac1",
            "c5" => 26.547932,
            "c6" => "Trac2",
            "c7" => -338.939697,
            "c8" => "AA1",
            "c9" => -364.611511,
           "c10" => "AA2",
           "c11" => 3968.13501,
           "c12" => "Reo1",
           "c13" => 0.0,
           "c14" => "Reo2",
           "c15" => 0.0,
           "c16" => "Latitud",
           "c18" => "Longitud",
           "c20" => "Speed",
           "c21" => 0.0,
           "c22" => "CVS",
           "c23" => 3873.429443,
      "column24" => nil,
       "ts_date" => "2016-02-25T23:00:22.984Z",
      "location" => {
        "lat" => 41.41974333333334,
        "lon" => 2.22535
    }
}

但是当我尝试在地图中可视化位置参数时，它不会显示任何结果：

我不知道自己做错了什么。为什么位置点不会出现在地图中？

Answer 1

在您的ES映射文件中，您可能需要启用geohash子字段的存储（默认为false），因为如果没有它，geohash聚合将无法工作。

{
  "template": "tram3",
  "order":    1,
  "settings": {
    "number_of_shards": 1
  },
  "mappings": {
    "tram3": {
      "_all": {
        "enabled": false
      },
      "properties": {
          "location": {
            "type": "geo_point",
            "geohash": true,           <-- add this
            "geohash_prefix": true     <-- add this
        }
      }
    }
  }
}

然后，您可以在location.geohash字段

上构建地理位置聚合

请注意，如果您还要为所有geohash前缀编制索引，还可以将"geohash_prefix": true添加到字段映射中。

<强>更新

重现案例之后，还有一些其他修复方法：

您需要更改type输入中的file，因为它将用作文档类型，并且您的映射指定映射类型的名称为dades2而不是{{1} }：

Dades

您的file { path => "/opt/logstash-2.3.1/logTest/Dades.csv" type => "dades2" start_position => "beginning" sincedb_path => "/dev/null" } 输出应如下所示，即elasticsearch应为true并使用manage_template文件的完整路径（请务必更改dades2_template.json实际路径名称。

/full/path/to

新的elasticsearch { hosts => localhost index => "dades2" manage_template => true template => "/full/path/to/dades2_template.json" template_name => "dades2" template_overwrite => "true" } 文件应如下所示

dades2_template.json