Coordinate Map Does Not Retrieve Information from Wildcard

Good morning!

I was building a visualization on kibana, specifically a coordinate map, it is loading info from the index pattern as usually but when I try to buid a new coordinate map that loads the coordinates using a wildcard (in this case I only have an index pattern which I want the wildcard to make reference of), no information is retrieved, when I look into the configuration fields of the wildcard does not show conflict as a type of field but geo_point, I appreciate any help on this matter

Hi, have you checked the query that is triggered using the Inspect tab? You can try to run that query against your pattern from the Dev Tools and see if you get some further info about what could be causing that.

For example, using the Flights dataset, when creating a new Coordinate Map in 7.5.1 you get this query when you ask for the last year fo data

{
  "aggs": {
    "2": {
      "geohash_grid": {
        "field": "OriginLocation",
        "precision": 2
      },
      "aggs": {
        "3": {
          "geo_centroid": {
            "field": "OriginLocation"
          }
        }
      }
    }
  },
  "size": 0,
  "_source": {
    "excludes": []
  },
  "stored_fields": [
    "*"
  ],
  "script_fields": {
    "hour_of_day": {
      "script": {
        "source": "doc['timestamp'].value.hourOfDay",
        "lang": "painless"
      }
    }
  },
  "docvalue_fields": [
    {
      "field": "timestamp",
      "format": "date_time"
    }
  ],
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "match_all": {}
        },
        {
          "range": {
            "timestamp": {
              "format": "strict_date_optional_time",
              "gte": "2019-02-21T15:48:08.658Z",
              "lte": "2020-02-21T15:48:08.658Z"
            }
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  }
}

You can copy that query payload and paste in into the Dev Tools with the following request and see the results

GET kibana_sample_data_flights/_search
{ ... }

I inspected the visualization and requested that query on the wildcard following the steps you have provided, I do not see in the response query, references to the index pattern that has the geo_point information, which is confusing because when you start the visualization tool to create that map kibana loads the geohash I am looking for but when you click on play button no information shows, also when loading the wildcard fields the geopoint is there as searchable and agregatable.

What I really need to accomplish is to use wildcard to load info on a map, it does it from an index pattern but no from wildcard

Sorry but I don't follow what you mean by wildcard here. Coordinate maps can be created from a saved search or index patterns. Maybe could you share some screenshots or code of what you are trying to accomplish? Which versions of the Elastic Stack are you using?

Yes of course! Let me share pictures here:
This is the NDJSON I want to load into a kibana coordinate an example data like:
{"index":{"_id":10}}
{"zone":"11.1111, 02.0000","latitude":"11.1111","longitude":"02.0000", "date":"12/02/2020"}
when I create the index pattern testing1:


after the map loads well, I create the index pattern testing* and it correctly imports the data:

after that, when creating the visualization coordinate map using the index pattern testing*:

nothing shows up

Thanks for sharing your screenshots and data. Not sure what's going on, I haven't been able to reproduce so let me share my steps:

On a 7.6.0* instance I created an index with your schema and added the same document you shared:

PUT /discuss_testing/
{
  "mappings": {
    "properties": {
      "zone": { "type": "geo_point"},
      "latitude": { "type": "float"},
      "longitude": { "type": "float"},
      "date": {"type": "date", "format": "dd/MM/yyyy"}
    }
  }
}

POST /discuss_testing/_bulk
{"index":{"_id":10}}
{"zone":"11.1111, 02.0000","latitude":"11.1111","longitude":"02.0000", "date":"12/02/2020"}

Then I created two index patterns one just for the index and another with the wildcard for potentially any new indexes:

image

Now, both index patterns allow me to create a new Coordinate Map visualization without issues:

Am I doing something differently than you? Which version of the Elastic Stack are you using?

* Mind that for 7.6.0 the Region and Coordinate Map visualizations need to be enabled explicitly using this setting in the kibana.yml file: xpack.maps.showMapVisualizationTypes: true.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.