elasticsearch - Unable to show location in tile map of kibana -


i using elasticsearch-1.5.1, kibana-4.0.2-linux-x86, logstash-1.4.2. logstash conf this

input{      redis{          data_type=>'list'  		key=>'pace'  		password=>'bhushan'  		type=>pace      }  }filter {  	geoip {  		source => "mdc.ip"  		target => "geoip"  		database => "/opt/logstash-1.4.2/vendor/geoip/geolitecity.dat"  		add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]  		add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]  	}  }    output{      if[type]=="pace"{          elasticsearch{             template_overwrite => true             host=>localhost     index=>'pace'     template => "/opt/logstash-1.4.2/mytemplates/elasticsearch-template.json"     template_name => "bhushan"          }      }  	  	stdout{          codec=>rubydebug      }  }
elasticsearch-template.json is

{    "template" : "bhushan",    "settings" : {      "index.refresh_interval" : "5s"    },    "mappings" : {      "_default_" : {         "_all" : {"enabled" : true},         "dynamic_templates" : [ {           "string_fields" : {             "match" : "*",             "match_mapping_type" : "string",             "mapping" : {               "type" : "string", "index" : "analyzed", "omit_norms" : true,                 "fields" : {                   "raw" : {"type": "string", "index" : "not_analyzed", "ignore_above" : 256}                 }             }           }         } ],         "properties" : {           "@version": { "type": "string", "index": "not_analyzed" },           "geoip"  : {             "type" : "object",               "dynamic": true               "properties" : {                 "location" : { "type" : "geo_point" }               }           }         }      }    }  }

when url curl http://localhost:9200/pace/_mapping/pace/field/geoip.location?pretty

{   "pace" : {     "mappings" : {       "pace" : {         "geoip.location" : {           "full_name" : "geoip.location",           "mapping" : {             "location" : {               "type" : "double"             }           }         }       }     }   } }

example of log record like

{     "thread_name" => "main",          "mdc.ip" => "14.x.x.x",         "message" => "hii, m in info",      "@timestamp" => "2015-05-15t10:18:32.904+05:30",           "level" => "info",            "file" => "test.java",           "class" => "the.bhushan.log.test.test",     "line_number" => "15",     "logger_name" => "bhushan",          "method" => "main",        "@version" => "1",            "type" => "pace",           "geoip" => {                       "ip" => "14.x.x.x",            "country_code2" => "in",            "country_code3" => "ind",             "country_name" => "india",           "continent_code" => "as",              "region_name" => "16",                "city_name" => "mumbai",                 "latitude" => 18.974999999999994,                "longitude" => 72.82579999999999,                 "timezone" => "asia/calcutta",         "real_region_name" => "maharashtra",                 "location" => [             [0] 72.82579999999999,             [1] 18.974999999999994         ],              "coordinates" => [             [0] "72.82579999999999",             [1] "18.974999999999994"         ]     } }

i thought problem same this, did mention in link deleting old index , restarting of ls , es no luck. appreciated.

your logstash filter storing coordinates in field geoip.coordinates, in elasticsearch-template.json mapping field called geoip.location. shows in sample log record can see 2 fields location , coordinates in geoip sub-object.

i think if change in logstash filter, might good:

from this

add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ] add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]

to this

add_field => [ "[geoip][location]", "%{[geoip][longitude]}" ] add_field => [ "[geoip][location]", "%{[geoip][latitude]}" ]

updates

  1. the 2 add_field directives in geoip filter can removed unnecessary
  2. "path": "full" can removed it's been deprecated since es v1.0
  3. the template name should pace instead of bushan, i.e. name of index log records stored.

Comments

Post a Comment

Popular posts from this blog

javascript - three.js lot of meshes optimization -

i'd use three.js render scene containing lot of small meshes create stacks. here's fiddle: http://jsfiddle.net/3bl6fbse/ i'd guys me optimizing code. can see, bit laggy because of low fps. i've written code fast, , m aware creating materials , meshes in loop bad practice. thing need know is: how optimize scene, not doing basic techniques creating materials , meshes outside of loop. i tried use meshes scale's property result ugly, there isn't "stack" effect. tried use mesh.copy ends on same bad performance. thanks
Read more

smartface.io - Proper way to change color scheme for whole application -

pls give me hint best way change color scheme whole smartface application: 1. statically (before building project) 2. dynamically (from within running application) if going change scheme 1 time, can change statically. can define new colors, , change old ones in .pge files. but if want change scheme colors more once or while using application, can in runtime dynamically. done in script files. objects properties such fillcolor can changed in scripts. i cannot 1 best changing in runtime looks better. example, can use editbox colors, , can use button, when pressed can change color scheme, etc.
Read more

Email notification in google apps script -

https://support.google.com/docs/answer/91588?hl=en i have sheet the cells filled in data pulled via apps script, website. pull in exact same data, not. on old sheets version use able emails when data "changes" different value. new sheets, email when new data pasted cells, though exact same data......and, can't set @ ranges anymore, entire document. there easy way watch cells when data changes, , email myself? this looks lot you're trying do. for checking whether value has changed after edit, this gives necessary information it. hence, know whether new value same 1 or not. implementing "workaround" talked in second link, able compare , send email myself if value changed. initiate onedit trigger goes off onedit function uses these lines after checks in place have passed. var email = "xyz@whatever.com"; mailapp.sendemail(email, "triggermail", "a change has occurred in sheet"); note: sends "notification...
Read more