我们正在尝试使用ELK 6.3版中的.conf文件和.json(模板文件)将数据推送到elasticsearch中。最初,我们使用模板文件将数据成功推送到ELK 4.x版本,并且能够在地图上渲染点。但是在新版本中,无论是否使用模板文件,lat和lon在Kibana中仅被视为数字。
我们如何推lat,lon以使其具有geopoint类型?我们正在尝试使用logstash配置文件推送数据。
这是我们的.conf文件:
[input
{
file
{
path => "/home/ubuntu/file.csv"
start_position => "beginning"
}
}
filter {
csv {
separator => ","
columns => \[
"CASCADE",
"Accessibility",
"Sustainability",
"CONNECTION_FAIL_per",
"RRC_CONNECTION_ATTEMPT",
"eCSFB_to_CDMA1XRTT_Exe_Succ_Count",
"eCSFB_Preparation_Success_Rate",
"eCSFB_Overall_Success_Rate",
"CSFB_Attempts",
"Total_PUCCH_PRB_UL_per",
"lat",
"lon"
\]
}
mutate { convert => {"lat" => "float"} }
mutate { convert => {"lon" => "float"} }
mutate { rename => {"lat" => "\[location\]\[lat\]"} }
mutate { rename => {"lon" => "\[location\]\[lon\]"} }
}
output {
elasticsearch {
template => "/usr/share/elasticsearch/new.json"
template_overwrite => true
hosts => "localhost:9200"
index => "new"
workers => 1
}
stdout {}
}
template file : new.json
{
"template" : "new",
"settings" : {
"index.refresh_interval" : "5s"
},
"mappings" : {
"_default_" : {
"_all" : {"enabled" : true, "omit_norms" : true},
"dynamic_templates" : \[ {
"message_field" : {
"match" : "message",
"match_mapping_type" : "string",
"mapping" : {
"type" : "string", "index" : "analyzed", "omit_norms" : true,
"fielddata" : { "format" : "disabled" }
}
}
}, {
"string_fields" : {
"match" : "*",
"match_mapping_type" : "string",
"mapping" : {
"type" : "string", "index" : "analyzed", "omit_norms" : true,
"fielddata" : { "format" : "disabled" },
"fields" : {
"raw" : {"type": "string", "index" : "not_analyzed", "ignore_above" : 256}
}
}
}
} \],
"properties" : {
"@timestamp": { "type": "date" },
"@version": { "type": "string", "index": "not_analyzed" },
"geoip" : {
"dynamic": true,
"properties" : {
"ip": { "type": "ip" },
"location" : { "type" : "geo_point" },
"lat" : { "type" : "float" },
"lon" : { "type" : "float" }
}
},
"location" : { "type": "geo_point" }
}
}
}
}]
请让我们知道如何转换为地理点