将坐标存储为 geo_point 的问题

Question

我遇到了将坐标存储为 geo_point 的问题。我的目标是通过我收到的 JSON 格式的 Logstash 管道将文档添加到 ElasticSearch。省略大部分字段后，JSON 如下所示：

{
    "text": "hello",
    "location": {
    "lat": "42.5064128",
    "lon": "1.52069438894224"
    }
}

由于我是 ELK 堆栈的新手，因此我创建了一个最小、完整且可验证的示例：

/etc/logstash/conf.d/mycompany-tweet-demo.conf：

input {
    tcp {
        port => 10000
        codec => "json"
    }
}

filter {    
    mutate {
        # this "works", however the location in no way matches the coordinates when displayed via tile map in Kibana
        #add_field => { "mylocation" => 52 }
        #add_field => { "mylocation" => 8 }

        # this yields "illegal latitude value [268.76953125] for mylocation"
        add_field => { "mylocation" => 51.9 }
        add_field => { "mylocation" => 7.9 }

        # this yields "illegal latitude value [269.1322946548462] for mylocation" for the demo JSON
        #add_field => { "mylocation" => "%{[location][lat]}" }
        #add_field => { "mylocation" => "%{[location][lon]}" }
    }
}

output {
    elasticsearch {
        hosts => "http://localhost:9200"
        index => "mycompany-tweet-demo"
        document_type => "tweet"

        template => "/etc/logstash/templates/mycompany-demo-template.json"
        template_overwrite => true
    }
}

/etc/logstash/templates/mycompany-demo-template.json:

{
    "template": "mycompany-*",
    "mappings": {
        "_default_": {
            "properties": {
                "mylocation" : {
                    "type" : "geo_point"
                }
            }
        }
    }
}

~/one.json:

{"text":"hello","location":{"lat":"42.5064128","lon":"1.52069438894224"}}

猫 ~/one.json | nc 本地主机 10000

[2017-01-13T17:41:38,504][WARN ][logstash.outputs.elasticsearch] Failed action. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"mycompany-tweet-demo", :_type=>"tweet", :_routing=>nil}, 2017-01-13T16:41:38.458Z 0:0:0:0:0:0:0:1 %{message}], :response=>{"index"=>{"_index"=>"mycompany-tweet-demo", "_type"=>"tweet", "_id"=>"AVmYtLvEovM5deO5CNpA", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"illegal latitude value [269.1322946548462] for mylocation"}}}}}

根据geo_point 的文档和我读过的关于stackoverflow 的一些帖子，我希望我的示例值在0 到90 之间时能够正常工作。谁能指出我做错了什么？

Answer 1

你快到了，你需要做的是：

    add_field => { "[mylocation][lat]" => "%{[location][lat]}" }
    add_field => { "[mylocation][lon]" => "%{[location][lon]}" }