CODEWITHSUNDEEP
elasticsearchlogstashelasticsearch-5aws-elasticsearch
Juhan
Juhan

Reputation: 1291

Not Able to generate geo_point field with geo_point data type Logstash

I'm trying to load data from mysql table ES index using logstash. I'm able to load the data into ES but the location field mapping is not not coming as geo_point type. Its showing as keyword type. So that I'm not able to query on geo_point field.

Any help what is the issue? ES version: 6.7.0

This is my template.json file:

{
    "settings" :
    {
        "number_of_shards" : 1,
        "codec": "best_compression",
        "number_of_replicas" : 0,
        "index.translog.flush_threshold_size": "2g",
        "bootstrap.mlockall": true,
        "indices.fielddata.cache.size": 25%
    },
    "mappings":
    {
            "_doc" :
            '|            "dynamic_templates":
              [
                  {
                      "message_field": {
                        "path_match": "message",
                        "match_mapping_type": "string",
                        "mapping": {
                          "type": "text",
                          "norms": false
                        }
                      }
                    },
                    {
                      "string_fields": {
                        "match": "*",
                        "match_mapping_type": "string",
                        "mapping": {
                          "type": "text",
                          "norms": false,
                          "fields": {
                            "keyword": {
                              "type": "keyword",
                              "ignore_above": 256
                            }
                          }
                        }
                      }
                    }
              ],
"properties" : {
                "@timestamp": {
                     "type": "date"
                },
                "@version": {
                     "type": "keyword"
                },
                "location": {
                     "type": "geo_point"
                },
                "lat" : { "type" : "keyword", "index" : "not_analyzed","index_options" : "docs" },
                "lon" : { "type" : "keyword", "index" : "not_analyzed","index_options" : "docs" }
              }
            }
    }
}

logstash.conf fileinput

{
        jdbc {
                ..........
    }
}
filter
{
    mutate {
        convert => { "lon" => "float" }
        convert => { "lat" => "float" }
        rename => {
            "lon" => "[location][lon]"
            "lat" => "[location][lat]"
        }
    }
}
output {
  elasticsearch {
        hosts => "host:80"
        index => "my_index"
        manage_template => "false"
        document_type => "_doc"
        template_name=>"template.json"
        document_id => "%{id}"
  }
}

Upvotes: 0

Views: 164

Answers (1)

Val
Val

Reputation: 217554

I think you're just missing manage_template => true and you can also add template_overwrite => true just to make sure the template is overridden:

  elasticsearch {
        hosts => "host:80"
        index => "my_index"
        manage_template => "true"             <---- change this
        template_overwrite => true            <---- also add this
        document_type => "_doc"
        template_name=>"template.json"
        document_id => "%{id}"
  }

Upvotes: 1

Related Questions