Adding geo location to bettermap

[goochjs]

Hi,

I want to create a visualisation of some data that includes geo-points. They're stored as lat,long in the field [geoip][location].

I add the panel to a row in a dashboard and pick geoip.location as the coordinate field. However, the Save button then doesn't seem to work. I can see from the tooltip that the coordinate field needs to be a geoJSON array but I thought that ElasticSearch sorted that out for you, if a field's mapping was set to be geo-point.

I've checked the mapping definition; it says:-

Code: Select all

          "geoip" : {
            "dynamic" : "true",
            "properties" : {
              "location" : {
                "type" : "geo_point"
              }
            }
          }

My data includes the field:-

Code: Select all

geoip.location	  	50.400965,-5.103651

Have I misunderstood how geo works? Does my logstash config need to format the lat/long differently? Or is there another reason why bettermap might not work?

Thanks,

J.

[cdienger]

What do you mean by the save button not working? Can you provide screenshots? What version of NLS is this?

I set up a quick test just using the following filter(your source may be different):

geoip {
source => "clientip"
}

Log stash will take care of parsing and creating the various geolocation fields including geoip.location which can be used in bettermaps.

[goochjs]

Hi,

Thanks for the reply.

It's v2.0.1.

This is the sequence of events I follow when trying to set up the report:-

1. – “add panel to empty row”

2. – select “bettermap”

bm-2.png

3. – give it a name and choose “geoip.location” as “Coordinate Field” (appears in dropdown)

bm-3.png

4. – the “Save” button doesn’t do anything (but “Cancel” works fine)

bm-4.png

The source data comes as a string "lat,lon", which I map to "[geoip][location]" in Logstash (i.e. via a filter in NLS's "Global Config" screen).

J.

[cdienger]

I was able to reproduce this on a 2.0.1 machine. Upgrading to 2.0.4 should resolve the problem:

https://assets.nagios.com/downloads/nag ... Server.pdf

[goochjs]

Hi,

I'm afraid the upgrade doesn't seem to have made a difference.

Is it possible that it's a problem in the data config? Can you share details of how you recreated the problem in 2.0.1 and saw it resolved in 2.0.4? There's always a chance that the problem is in my chair rather than in the computer.

J.

[scottwilkerson]

The source data comes as a string "lat,lon", which I map to "[geoip][location]" in Logstash (i.e. via a filter in NLS's "Global Config" screen).

Can you show how you are doing this in the configs? you generally need to do something like this in the filters

Code: Select all

geoip {
        source => 'clientip'
    }

[goochjs]

Thanks for the reply.

It's not an IP address, I've just got "lat,lon" in a string and am mapping it into the field geoip.location.

The data comes in like this:-

Code: Select all

GPS Coordinates=51.407416,0.060661 GPS DoP=1

My logstash mapping looks like this:-

Code: Select all

GPS Coordinates=%{DATA:[geoip][location]} GPS DoP=%{INT:gps_dop}

That said, however, I realised that it wasn't just bettermap that had a problem. I couldn't even add a simple text panel to a row.

I had been using Chrome, so I then tried IE and I was able to add the panels. Are there any known problems with Chrome?

Now, however, bettermap doesn't ever display anything. It just has a progress bar ticking along. I could see an error at the top, which said "time field must be consistent amongst time filters". My data uses a field called "insert_timestamp" as a record of when the event happened. I clicked on "inspect" on the bettermap and could see two time fields in use:-

Code: Select all

"filter": {
        "bool": {
          "must": [
            {
              "range": {
                "@timestamp": {
                  "from": 1534754373686,
                  "to": 1534927173687
                }
              }
            },
            {
              "range": {
                "event_timestamp": {
                  "from": 1534848764231,
                  "to": 1534854681871
                }
              }
            },
...

I then noticed that I had a query at the top of the dashboard that used @timestamp, so I deleted it and the error went away.

All good progress, but I've still not got a map with my data showing on it.

J.

[scottwilkerson]

I think the problem is that you are just entering a string as and the field isn't set as a geo_point

https://www.elastic.co/guide/en/elastic ... point.html

I believe adding the following logstash filter should do it, but you would need to wait until the next index is created after applying the change (tomorrow) or delete the current index

Code: Select all

mutate {
    convert => { "[geoip][location]" => "geo_point" }
  }

[goochjs]

I can do that, although I did query the mapping in ElasticSearch and it told me:-

Code: Select all

$ curl -XGET 'http://localhost:9200/logstash-2018.08.22/_mapping?pretty' | less

Code: Select all

          ...
          "geoip" : {
            "dynamic" : "true",
            "properties" : {
              "location" : {
                "type" : "geo_point"
              }
            }
          },
          ...

So, my assumption was that geoip.location was already a geo_point (in fact, that was why I chose it as the target field - it was already in the index before I added the new dataset).

J.

[scottwilkerson]

Then I'm a little bit at a loss, best I can suggest would be to turn on your browser development tools and see if you get errors in the console when you open the dashboard that might lead in a direction.

I've only ever created maps with the geoip function which I know creates the correct fields.