0

I'm a new in elastic search and I'm not sure how to define a geo_point type if I add data to an existing index from a diferent source.

If I create a new index everything works:

My logstash geo.conf file:

input {
    file {
        path => "/geoList.csv"
        sincedb_path => "/dev/null"
        start_position => "beginning"
    }
}
filter {
    csv {
        separator => ";"
        columns => [ "Country","LATITUDE","LONGITUDE"]
    }
        mutate {
                convert => { "LATITUDE" => "float" }
                convert => { "LONGITUDE" => "float" }
   }
        mutate {
               rename => {
               "LONGITUDE" => "[location][lon]"
               "LATITUDE" => "[location][lat]"
  }    
}
}
output {
    stdout {
        codec => rubydebug
    }
    elasticsearch {
    index => 'geomap'
    }
}

after that I create a template for my new index

PUT _template/geo_template
{
   "template": "geomap",
   "mappings": {
       "logs" : {
           "properties" : {
               "location" :  {
                   "type" : "geo_point"
               }
           }
       }
   }
}

And I can create a map and I have 

location    geo_point

But if I try to use geo.conf to add to my existing index 

    elasticsearch {
    index => 'existingindex'
    }

In the existing index I have 2 fields now:

location.lat    number  
location.lon    number

but I need to have a one field to create a map visualisation:

location    geo_point

I cannot get this field. I think the problem is that I need to to add mapping or a template but I don't know how to edit existing one from the existing index

Anna K
  • 1,666
  • 4
  • 23
  • 47
  • You cannot modify a mapping once created. You need to delete the index and recreate it with the proper mapping. – Val Feb 15 '17 at 15:40
  • How can I create a new mapping? Is it possible that I copy an old mapping and add only a geo_point type? – Anna K Feb 15 '17 at 15:45
  • The template is correct, but it must exist before the index is created. – Val Feb 15 '17 at 15:48
  • You must also make sure to add `document_type => "logs"` to make sure that the template is used – Val Feb 15 '17 at 15:49
  • where should I add this document_type => "logs"? I deleted index, added first data with lat and lon plus template and there was a geo_point but after I added old source data again geo_point filed disapears and I'm getting again 2 fields location.lat number location.lon number – Anna K Feb 15 '17 at 16:13
  • In your `elasticsearch` output – Val Feb 15 '17 at 16:15

0 Answers0