# For All Indexes and Timestamps Kibana Maps Shows "No results found"

**URL:** https://discuss.elastic.co/t/for-all-indexes-and-timestamps-kibana-maps-shows-no-results-found/240588
**Category:** Kibana
**Created:** [July 9, 2020, 6:16pm UTC](https://discuss.elastic.co/t/for-all-indexes-and-timestamps-kibana-maps-shows-no-results-found/240588 "2020-07-09T18:16:53Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![alpo](https://avatars.discourse-cdn.com/v4/letter/a/54ee81/32.png) [@alpo](https://discuss.elastic.co/u/alpo)
#### Post date: [July 9, 2020, 6:16pm UTC](https://discuss.elastic.co/t/for-all-indexes-and-timestamps-kibana-maps-shows-no-results-found/240588/1 "2020-07-09T18:16:54Z")

</div>

All,

We're facing an interesting issue where Kibana Maps fails to find data within Elasticsearch. However, all other visualizations do find the data.

A few bulleted notes for your consideration:

- When creating a new map, each index is selectable and the correct geoip fields are shown as options in "Geospatial field"
- Data can be found in the "Discovery" tab
- In the "Discovery" tab, we can see that each document does possess properly formatted geoip fields
- Each index is verified to possess properly formatted geoip fields
- The @timestamp is formatted two different ways; one with %{SYSLOGTIMESTAMP:timestamp} and then using the Logstash Date plugin (target =\> "@timestamp"), and the other is accomplished automatically by a pipeline. Nonetheless, the @timestamp fields appear to be properly formatted and can be sucessffully queried by the "Discovery" tab.
- When creating a new Kibana Map, we selected multiple values for time (i.e. "Today", "Last 15 Minutes", "Last 1 Year") but all of them produce the same result ("No results found").
- We also deleted all indexes and index patterns and re-initialized all the data, to no avail.
- We also uninstalled and reinstalled both Elasticsearch and Kibana with the same results.

Here is the query from Kibana to Elasticsearch:

```auto
{
  "size": 0,
  "aggs": {
    "gridSplit": {
      "geotile_grid": {
        "field": "dst_geoip.location",
        "precision": 4
      },
      "aggs": {
        "gridCentroid": {
          "geo_centroid": {
            "field": "dst_geoip.location"
          }
        }
      }
    }
  },
  "stored_fields": [
    "*"
  ],
  "script_fields": {},
  "docvalue_fields": [
    {
      "field": "@timestamp",
      "format": "date_time"
    }
  ],
  "_source": {
    "excludes": []
  },
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "match_all": {}
        },
        {
          "geo_bounding_box": {
            "dst_geoip.location": {
              "top_left": [
                -180,
                89
              ],
              "bottom_right": [
                180,
                -89
              ]
            }
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "2020-07-10T00:06:10.466Z",
              "lte": "2020-07-10T00:21:10.466Z",
              "format": "strict_date_optional_time"
            }
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  }
}
```

And the response:

```auto
{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 4,
    "successful": 4,
    "skipped": 3,
    "failed": 0
  },
  "hits": {
    "total": 0,
    "max_score": null,
    "hits": []
  },
  "aggregations": {
    "gridSplit": {
      "buckets": []
    }
  }
}
```

Compare this with a Line Graph Visualization request...

```auto
{
  "aggs": {
    "2": {
      "date_histogram": {
        "field": "@timestamp",
        "fixed_interval": "30m",
        "time_zone": "America/Los_Angeles",
        "min_doc_count": 1
      }
    }
  },
  "size": 0,
  "stored_fields": [
    "*"
  ],
  "script_fields": {},
  "docvalue_fields": [
    {
      "field": "@timestamp",
      "format": "date_time"
    }
  ],
  "_source": {
    "excludes": []
  },
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "match_all": {}
        },
        {
          "range": {
            "@timestamp": {
              "gte": "2020-07-09T07:00:00.000Z",
              "lte": "2020-07-10T06:59:59.999Z",
              "format": "strict_date_optional_time"
            }
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  }
}
```

And the response:

```auto
{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 4,
    "successful": 4,
    "skipped": 2,
    "failed": 0
  },
  "hits": {
    "total": 1220,
    "max_score": null,
    "hits": []
  },
...
```

Thought the community might be able to shed light on why Kibana Maps and/or Elasticsearch might be acting this way.

Thanks in advance for any assistance you can provide.

---

<div class="post-metadata">

### Author: ![alpo](https://avatars.discourse-cdn.com/v4/letter/a/54ee81/32.png) [@alpo](https://discuss.elastic.co/u/alpo)
#### Post date: [July 10, 2020, 6:10pm UTC](https://discuss.elastic.co/t/for-all-indexes-and-timestamps-kibana-maps-shows-no-results-found/240588/2 "2020-07-10T18:10:16Z")

</div>

Solved. Had to manually add the geoip.location field in the geoip filter:

```auto
add_field => ["geoip.location", "%{[geoip][latitude]}, %{[geoip][longitude]}" ]
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 7, 2020, 6:10pm UTC](https://discuss.elastic.co/t/for-all-indexes-and-timestamps-kibana-maps-shows-no-results-found/240588/3 "2020-08-07T18:10:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.