logstash/logstash — pull request #582 by bfritz (2013-08-19 16:03:02+00:00)
Title: - add lonlat field to geoip filter

Duplicate longitude and latitude into a GeoJSON-friendly `lonlat` field.

I struggled to setup logstash with Kibana3 and its bettermap panel. Apparently I'm not the only one:
elasticsearch/kibana#237
http://comments.gmane.org/gmane.comp.sysutils.logstash.user/4049

This change is a hack because it duplicates latitude and longitude in the event. Might be better for the behavior to be configurable and off by default.

FWIW, prior to this change, my solution to the "lonlat problem" was:

ruby {
type => "nginx"
tags => [ "geoip" ]
code => "event['lonlat'] = [event['geoip.longitude'].to_f, event['geoip.latitude'].to_f]"
}

@jordansissel's recommendation on logstash-user did not work for me, even after updating ElasticSearch's mappings--I was probably doing something wrong--and the ruby filter solutions seems less of a hack than the one in elasticsearch/kibana#237.