Logstash influxdb output with geoip feature

1

I’m trying to use logstash geoip filter to send data about location of IP address to InfluxDB via InfluxDB output plugin.

My logstash conf file is:

input {
  file {
    path => "/root/geoip_test.txt"
    start_position => "beginning"
  }
}

filter {
  geoip {
    source => "message"
    fields => ["latitude", "longitude"]
  }
}

output {
  stdout {codec => rubydebug}
  influxdb {
    host => "localhost"
    port => 8086
    db => "metrics"
    measurement => "geoip_test"
    codec => "json"
    use_event_fields_for_data_points => true
  }
}

geoip_test.txt file contains only one IP address:

14.143.35.10

Output with error I receive is:

[2020-09-07T12:26:26,696][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
{
         "geoip" => {
         "latitude" => 12.9771,
        "longitude" => 77.5871
    },
       "message" => "14.143.35.10",
          "path" => "/root/geoip_test.txt",
    "@timestamp" => 2020-09-07T10:26:33.963Z,
          "host" => "test",
      "@version" => "1"
}
[2020-09-07T12:26:34,942][WARN ][logstash.outputs.influxdb][main][941178b6897abb80f9a5f7654e5e62ba752d5e20b68781bc62b466e489c2ce56] Non recoverable exception while writing to InfluxDB {:exception=>#<InfluxDB::Error: {"error":"unable to parse 'geoip_test,host=test geoip={\"latitude\"=\u003e12.9771, \"longitude\"=\u003e77.5871},path=\"/root/geoip_test.txt\" 1599474393963': invalid boolean"}
>}

I think geoip filter generates some boolean field which InfluxDB is not able to work with.

Does anyone have any idea what to do with that? Is it possible to set up geoip filter in some way so it wouldn’t generate anything but lon and lat fields?

Any help is really appreciated!

2

It sounds like maybe InfluxDB has already seen a boolean value for one of your fields, and thus will try to convert all future values into a boolean type to match it. Have you previously written data to this database?