Can't get Tile Map working (Kibana 4.1.1, ElasticSearch 2.7.1)

Elastic Stack Kibana
#1

Though the Kibana tutorial works fine w/ the Tile Map, my data always gives me a 'no data found' error. The lat/longs are read in ok and the values are valid.

Below are the details:
The template seems simple enough:
curl -XPUT localhost:9200/_template/baby-names -d '
{
"template" : "baby-names",
"mappings" : {
"birth_data" : {
"dynamic_templates" : [ {
"string_fields" : {
"mapping" : {
"type" : "string", "index" : "not_analyzed", "omit_norms" : true
},
"match_mapping_type" : "string",
"match" : "*"
}
} ],
"_all": {
"enabled" : false
},
"properties" : {
"geo" : {
"properties" : {
"coordinates" : {
"type" : "geo_point"
}}}}}}}'

Also the logstash 'baby-names.conf' file seems straightforward:
input {
tcp {
port => 3333
} }
filter {
grok {
patterns_dir => "./patterns"
match => ["message", "%{TEXT_NO_COMMA:State},%{TEXT_NO_COMMA:Sex},%{NUMBER:year:int},%{TEXT_NO_COMMA:Name},%{NUMBER:NumBirths:int},%{NUMBER:latitude:float},%{NUMBER:longitude:float},%{TEXT_NO_COMMA:geohash}"]
}
mutate {
add_field => [logdate, "Jan 01 %{year}"]
}
mutate {
rename => {
"latitude" => "[geo][coordinates][lat]"
"longitude" => "[geo][coordinates][lon]"
}}
date {
match => ["logdate", "MMM dd YYYY"]
target => "@timestamp"
}}
output {
elasticsearch {
embedded => false
action => "index"
host => "localhost"
template_name => "baby-names"
index => "baby-names"
}}

Though the data looks good in Kibana with other graphs, the Tile Map always barfs. Any advice?

Thank you!

#2

You need a single geo field for KB to be able to map, you cannot have a lat and a lon in separate ones like that.

#3

Thank you for the help! After some struggles, here's what I learned which will hopefully save someone else some grief:

  1. Make sure your index is pointing to the right template.
    Get all templates from: curl -XGET localhost:9200/_template/*
  2. Check if your mapping is what you expect:
    curl -XGET 'localhost:9200/<index_name>/_mapping'?pretty
  3. In your Logstash config file, specify the right template_name, index and document_name:
    In Logstash config file:
    output {
    elasticsearch {
    action => "index"
    template_name => "templateNAME"
    index => "indexNAME"
    document_type => "documentTYPE" }
    In Elasticsearch template: (I made a JSON file to generate the template.)
    curl -XPUT localhost:9200/_template/indexNAME -d '
    "template" : "templateNAME",
    "mappings" : {
    "documentTYPE" : {
    ... (other stuff)
  4. Get the geo-coordinates aligned between Logstash and ElasticSearch
    In Logstash config file (I already have floating point fields called 'latitude' and 'longitude') :
    mutate {
    rename => {
    "latitude" => "[geo][coordinates][lat]"
    "longitude" => "[geo][coordinates][lon]"
    }}
    Back to the Elasticsearch template file. This is one level indented from the documentTYPE from before:
    "properties" : {
    "@version": { "type": "string", "index": "not_analyzed" },
    "geo" : {
    "properties" : {
    "coordinates" : {
    "type" : "geo_point"
    }}}

Hope this helps!

#4