Question

我面临着将坐标存储为geo_point的问题。我的目标是通过我以JSON格式接收的Logstash管道向ElasticSearch添加文档。省略大多数字段，JSON看起来像这样：

{
    "text": "hello",
    "location": {
    "lat": "42.5064128",
    "lon": "1.52069438894224"
    }
}

由于我是ELK堆栈的新手，我创建了一个最小，完整且可验证的示例：

/etc/logstash/conf.d/mycompany-tweet-demo.conf：

input {
    tcp {
        port => 10000
        codec => "json"
    }
}

filter {    
    mutate {
        # this "works", however the location in no way matches the coordinates when displayed via tile map in Kibana
        #add_field => { "mylocation" => 52 }
        #add_field => { "mylocation" => 8 }

        # this yields "illegal latitude value [268.76953125] for mylocation"
        add_field => { "mylocation" => 51.9 }
        add_field => { "mylocation" => 7.9 }

        # this yields "illegal latitude value [269.1322946548462] for mylocation" for the demo JSON
        #add_field => { "mylocation" => "%{[location][lat]}" }
        #add_field => { "mylocation" => "%{[location][lon]}" }
    }
}

output {
    elasticsearch {
        hosts => "http://localhost:9200"
        index => "mycompany-tweet-demo"
        document_type => "tweet"

        template => "/etc/logstash/templates/mycompany-demo-template.json"
        template_overwrite => true
    }
}

/etc/logstash/templates/mycompany-demo-template.json：

{
    "template": "mycompany-*",
    "mappings": {
        "_default_": {
            "properties": {
                "mylocation" : {
                    "type" : "geo_point"
                }
            }
        }
    }
}

〜/ one.json：

{"text":"hello","location":{"lat":"42.5064128","lon":"1.52069438894224"}}

cat~ / one.json | nc localhost 10000

[2017-01-13T17:41:38,504][WARN ][logstash.outputs.elasticsearch] Failed action. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"mycompany-tweet-demo", :_type=>"tweet", :_routing=>nil}, 2017-01-13T16:41:38.458Z 0:0:0:0:0:0:0:1 %{message}], :response=>{"index"=>{"_index"=>"mycompany-tweet-demo", "_type"=>"tweet", "_id"=>"AVmYtLvEovM5deO5CNpA", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"illegal latitude value [269.1322946548462] for mylocation"}}}}}

根据geo_point的文档和stackoverflow上的一些帖子我已经阅读过，我希望我的示例值为0到90之间可以正常工作。谁能指出我做错了什么？

Answer 1

你几乎就在那里，你需要做的是：

    add_field => { "[mylocation][lat]" => "%{[location][lat]}" }
    add_field => { "[mylocation][lon]" => "%{[location][lon]}" }

将坐标存储为geo_point的问题

1 个答案: