Hi
I changed the logstash definition and sending a "lon" field - it does pick up the geopoint correctly and shows it that way in the "Discover" tab - but I still can't see it in the visualization
PFA screenshots of the geopoint datatype and its index mapping
Following is the request response
Request
{
"aggs": {
"filter_agg": {
"filter": {
"geo_bounding_box": {
"ignore_unmapped": true,
"qp_points": {
"top_left": {
"lat": 90,
"lon": -180
},
"bottom_right": {
"lat": -90,
"lon": 180
}
}
}
},
"aggs": {
"3": {
"geohash_grid": {
"field": "qp_points",
"precision": 2
},
"aggs": {
"4": {
"geo_centroid": {
"field": "qp_points"
}
}
}
}
}
}
},
"size": 0,
"_source": {
"excludes": []
},
"stored_fields": [
"*"
],
"script_fields": {},
"docvalue_fields": [
{
"field": "@timestamp",
"format": "date_time"
}
],
"query": {
"bool": {
"must": [
{
"match_all": {}
},
{
"range": {
"@timestamp": {
"gte": 1574165051943,
"lte": 1574165351943,
"format": "epoch_millis"
}
}
},
{
"match_phrase": {
"apikey.keyword": {
"query": "<apikey>"
}
}
}
],
"filter": [],
"should": [],
"must_not": []
}
}
}
Response
{
"took": 51,
"timed_out": false,
"_shards": {
"total": 720,
"successful": 705,
"skipped": 700,
"failed": 0
},
"hits": {
"total": 307,
"max_score": 0,
"hits": []
},
"aggregations": {
"filter_agg": {
"3": {
"buckets": []
},
"doc_count": 0
}
},
"status": 200
}
Should I just use a new field altogether?
Also, Joe when you say "re-index existing data" I expect I need to run the update_by_query and delete_by_query commands to clean up the existing data fields (I have real time incoming data from the field)