无法按geoip.location过滤

Question

使用ELk 6.X似乎由于geoip.location未填充而无法绘制点吗？ 我还添加了一个模板，我希望它是正确的。不是专家，但是我很确定我的观点不会因为缺少的数据而得到呈现。

基巴纳语6.4.2 Logstash 6.4.2-1 Elasticsearch 6.4.2

以下配置

input {
  udp {
    port => 9996
    codec => netflow {
      versions => [5, 7, 9, 10]
    }
    type => netflow
 }
}

filter {
  geoip {
    source => "[netflow][ipv4_src_addr]"
    target => "src_geoip"
    database => "/usr/share/GeoIP/GeoLite2-City.mmdb"
  }
  geoip {
    source => "[netflow][ipv4_dst_addr]"
    target => "dst_geoip"
    database => "/usr/share/GeoIP/GeoLite2-City.mmdb"
  }
}

输出

output {
  if [type] == "netflow" {
    elasticsearch {
        hosts => ["localhost:9200"]
        index => "logstash-%{+YYYY.MM.dd}"
    }
  } else {
  elasticsearch {
    hosts => ["localhost:9200"]
    sniffing => true
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
}
}

映射就像这样

      "geoip": {
        "dynamic": "true",
        "properties": {
          "ip": {
            "type": "ip"
          },
          "latitude": {
            "type": "half_float"
          },
          "location": {
            "type": "geo_point"
          },
          "longitude": {
            "type": "half_float"
          }
        }
      },

模板

{
  "logstash": {
    "order": 0,
    "version": 60001,
    "index_patterns": [
      "logstash-*"
    ],
    "settings": {
      "index": {
        "refresh_interval": "5s"
      }
    },
    "mappings": {
      "_default_": {
        "dynamic_templates": [
          {
            "message_field": {
              "path_match": "message",
              "match_mapping_type": "string",
              "mapping": {
                "type": "text",
                "norms": false
              }
            }
          },
          {
            "string_fields": {
              "match": "*",
              "match_mapping_type": "string",
              "mapping": {
                "type": "text",
                "norms": false,
                "fields": {
                  "keyword": {
                    "type": "keyword",
                    "ignore_above": 256
                  }
                }
              }
            }
          }
        ],
        "properties": {
          "@timestamp": {
            "type": "date"
          },
          "@version": {
            "type": "keyword"
          },
          "geoip": {
            "dynamic": true,
            "properties": {
              "ip": {
                "type": "ip"
              },
              "location": {
                "type": "geo_point"
              },
              "latitude": {
                "type": "half_float"
              },
              "longitude": {
                "type": "half_float"
              }
            }
          }
        }
      }
    },
    "aliases": {}
  }
}

我的索引返回 src或dst，但仅限以下

#  dst_geoip.latitude               26.097
#  dst_geoip.location.lat           26.097
#  dst_geoip.location.lon           -80.181