我的CSV带有latitude
和longitude
列,我正在尝试在Logstash 2.3.3中创建geopoint
对象,以便我可以在Kibana 4.5.1中可视化这些值。
但是,当在Kibana中可视化数据时,我会看到location.lat
和location.lon
,均为float
类型,而不是类型geopoint
的location
。
我一般是麋鹿的新手,这让我发疯。特别是因为我发现的大多数信息已经过时了。
我正在使用的.conf
文件:
input {
file {
path => "C:/file.csv"
start_position => "beginning"
}
}
filter {
csv {
separator => ","
columns => ["longitude","latitude"]
}
mutate { convert => {"latitude" => "float"} }
mutate { convert => {"longitude" => "float"} }
mutate { rename => {"latitude" => "[location][lat]"} }
mutate { rename => {"longitude" => "[location][lon]"} }
mutate { convert => { "[location]" => "float" } }
}
output {
elasticsearch {
template => "...elasticsearch-template.json"
template_overwrite => true
action => "index"
hosts => "localhost"
index => "testindex1"
workers => 1
}
stdout {}
}
我指定的模板文件(elasticsearch-template.json
)如下:
{
"template" : "logstash-*",
"settings" : {
"index.refresh_interval" : "5s"
},
"mappings" : {
"_default_" : {
"_all" : {"enabled" : true, "omit_norms" : true},
"dynamic_templates" : [ {
"message_field" : {
"match" : "message",
"match_mapping_type" : "string",
"mapping" : {
"type" : "string", "index" : "analyzed", "omit_norms" : true,
"fielddata" : { "format" : "disabled" }
}
}
}, {
"string_fields" : {
"match" : "*",
"match_mapping_type" : "string",
"mapping" : {
"type" : "string", "index" : "analyzed", "omit_norms" : true,
"fielddata" : { "format" : "disabled" },
"fields" : {
"raw" : {"type": "string", "index" : "not_analyzed", "ignore_above" : 256}
}
}
}
} ],
"properties" : {
"@timestamp": { "type": "date" },
"@version": { "type": "string", "index": "not_analyzed" },
"geoip" : {
"dynamic": true,
"properties" : {
"ip": { "type": "ip" },
"location" : { "type" : "geo_point" },
"latitude" : { "type" : "float" },
"longitude" : { "type" : "float" }
}
},
"location" : { "type": "geo_point" }
}
}
}
}
如果有人可以帮助我或给我一些关于我做错了什么的见解,我将非常感谢。我也敢肯定,这将帮助和我在同一条船上的每个人。
我解决了它,并且现在正常工作。该模板正在寻找logstash-*
类型的索引,并且我正在使用testindex1
。将我的索引更改为logstash-%{+dd.MM.YYYY}
修复了它。
您需要删除最后一个mutate
过滤器,该过滤器破坏了您要实现的目标的目的。
还需要确保testindex1
映射忠实地包含您在elasticsearch-template.json
文件中的映射