# Geopoint visualization in Kibana 6.4.2 (Elastic 6.4.2)

**URL:** <https://discuss.elastic.co/t/geopoint-visualization-in-kibana-6-4-2-elastic-6-4-2/208468>\
**Category:** Kibana\
**Created:** [November 19, 2019, 9:29am UTC](https://discuss.elastic.co/t/geopoint-visualization-in-kibana-6-4-2-elastic-6-4-2/208468 "2019-11-19T09:29:55Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![samiujan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samiujan/32/23605_2.png) [@samiujan](https://discuss.elastic.co/u/samiujan)\
**Post date:** [November 19, 2019, 9:29am UTC](https://discuss.elastic.co/t/geopoint-visualization-in-kibana-6-4-2-elastic-6-4-2/208468/1 "2019-11-19T09:29:55Z")

</div>

I have an index pattern for my metrics that's configured as "filebeat-\*" in Kibana

I have a field called qp\_point - this is created by reading another field and running "mutate" in logstash

However, I cannot see visualizations for the same geopoint

Please see screenshots of visualization page and index mapping

 ![qp_point](https://us1.discourse-cdn.com/elastic/original/3X/2/b/2bcafc44b426517c22f8f6cdddefc753c9f4007e.png) ![qp_point_2](https://us1.discourse-cdn.com/elastic/original/3X/2/7/279a055b23614c0a8929b03100c4606b7a3d1aa5.png)

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [November 19, 2019, 10:19am UTC](https://discuss.elastic.co/t/geopoint-visualization-in-kibana-6-4-2-elastic-6-4-2/208468/2 "2019-11-19T10:19:07Z")

</div>

Hi @samiujan,

just to make sure I understand correctly - there is no data showing up on your map, right?

Could you check whether the field is actually populated with the expected data? If everything looks fine there, could you open the "Inspect" panel and copy/paste the request and response bodies of the actual request sent to elasticsearch?

---

<div class="post-metadata">

**Author:** ![samiujan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samiujan/32/23605_2.png) [@samiujan](https://discuss.elastic.co/u/samiujan)\
**Post date:** [November 19, 2019, 10:35am UTC](https://discuss.elastic.co/t/geopoint-visualization-in-kibana-6-4-2-elastic-6-4-2/208468/3 "2019-11-19T10:35:40Z")

</div>

Thanks Joe - I have attached screenshots of some of the data

 ![data_point_Type](https://us1.discourse-cdn.com/elastic/original/3X/b/1/b154a81c6326545c1517ee883ddae2cee2fc7b66.png)

\<I couldn't cross it out but I have removed the logstash definition since that is not the correct one\>

Also, following is the request and response result from "Inspect"

## Request

```
{
  "aggs": {
    "2": {
      "geohash_grid": {
        "field": "qp_points",
        "precision": 2
      },
      "aggs": {
        "3": {
          "geo_centroid": {
            "field": "qp_points"
          }
        }
      }
    }
  },
  "size": 0,
  "_source": {
    "excludes": []
  },
  "stored_fields": [
    "*"
  ],
  "script_fields": {},
  "docvalue_fields": [
    {
      "field": "@timestamp",
      "format": "date_time"
    }
  ],
  "query": {
    "bool": {
      "must": [
        {
          "match_all": {}
        },
        {
          "range": {
            "@timestamp": {
              "gte": 1574072899078,
              "lte": 1574159299078,
              "format": "epoch_millis"
            }
          }
        },
        {
          "match_phrase": {
            "apikey.keyword": {
              "query": "<apikey_here>"
            }
          }
        },
        {
          "match_phrase": {
            "uripath.keyword": {
              "query": "/search/rgeocode"
            }
          }
        }
      ],
      "filter": [],
      "should": [],
      "must_not": []
    }
  }
}

```

## Response

```
{
  "took": 47,
  "timed_out": false,
  "_shards": {
    "total": 720,
    "successful": 705,
    "skipped": 695,
    "failed": 0
  },
  "hits": {
    "total": 72438,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "2": {
      "buckets": []
    }
  },
  "status": 200
}

```

It seems "qp\_points" is empty but qp\_points.lat and qp\_points.lng do exist...

Should renaming "lng" to "lon" help? Since the geopoint definition seems to have "lon" as a field type and not lng....

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [November 19, 2019, 10:40am UTC](https://discuss.elastic.co/t/geopoint-visualization-in-kibana-6-4-2-elastic-6-4-2/208468/4 "2019-11-19T10:40:27Z")

</div>

Right, it should be `lon` instead of `lng` for the index field to pick up your data correctly. For reference, there are also others ways to index `geo_point` data, but `lng` for longitude is not supported: [https://www.elastic.co/guide/en/elasticsearch/reference/current/geo-point.html#geo-point](https://www.elastic.co/guide/en/elasticsearch/reference/current/geo-point.html#geo-point).

Looks like the `lng` data is just ignored by the geo point index, this is why nothing shows up. You have to re-index your existing data with the correct field names, then it should work.

---

<div class="post-metadata">

**Author:** ![samiujan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samiujan/32/23605_2.png) [@samiujan](https://discuss.elastic.co/u/samiujan)\
**Post date:** [November 19, 2019, 10:47am UTC](https://discuss.elastic.co/t/geopoint-visualization-in-kibana-6-4-2-elastic-6-4-2/208468/5 "2019-11-19T10:47:10Z")

</div>

Thanks a lot for the help Joe!

---

<div class="post-metadata">

**Author:** ![samiujan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samiujan/32/23605_2.png) [@samiujan](https://discuss.elastic.co/u/samiujan)\
**Post date:** [November 19, 2019, 12:13pm UTC](https://discuss.elastic.co/t/geopoint-visualization-in-kibana-6-4-2-elastic-6-4-2/208468/6 "2019-11-19T12:13:33Z")

</div>

Hi

I changed the logstash definition and sending a "lon" field - it does pick up the geopoint correctly and shows it that way in the "Discover" tab - but I still can't see it in the visualization

PFA screenshots of the geopoint datatype and its index mapping

 ![qp_31](https://us1.discourse-cdn.com/elastic/original/3X/0/a/0a3cd0c79c20c5f4d2b039cb173158493cb0f13f.png) ![qp_3](https://us1.discourse-cdn.com/elastic/original/3X/a/1/a132ee8f07c8453d8b70922d47e029b09b3d52c0.png)

Following is the request response

## Request

```
{
  "aggs": {
    "filter_agg": {
      "filter": {
        "geo_bounding_box": {
          "ignore_unmapped": true,
          "qp_points": {
            "top_left": {
              "lat": 90,
              "lon": -180
            },
            "bottom_right": {
              "lat": -90,
              "lon": 180
            }
          }
        }
      },
      "aggs": {
        "3": {
          "geohash_grid": {
            "field": "qp_points",
            "precision": 2
          },
          "aggs": {
            "4": {
              "geo_centroid": {
                "field": "qp_points"
              }
            }
          }
        }
      }
    }
  },
  "size": 0,
  "_source": {
    "excludes": []
  },
  "stored_fields": [
    "*"
  ],
  "script_fields": {},
  "docvalue_fields": [
    {
      "field": "@timestamp",
      "format": "date_time"
    }
  ],
  "query": {
    "bool": {
      "must": [
        {
          "match_all": {}
        },
        {
          "range": {
            "@timestamp": {
              "gte": 1574165051943,
              "lte": 1574165351943,
              "format": "epoch_millis"
            }
          }
        },
        {
          "match_phrase": {
            "apikey.keyword": {
              "query": "<apikey>"
            }
          }
        }
      ],
      "filter": [],
      "should": [],
      "must_not": []
    }
  }
}

```

## Response

```
{
  "took": 51,
  "timed_out": false,
  "_shards": {
    "total": 720,
    "successful": 705,
    "skipped": 700,
    "failed": 0
  },
  "hits": {
    "total": 307,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "filter_agg": {
      "3": {
        "buckets": []
      },
      "doc_count": 0
    }
  },
  "status": 200
}

```

Should I just use a new field altogether?

Also, Joe when you say "re-index existing data" I expect I need to run the **update\_by\_query** and **delete\_by\_query** commands to clean up the existing data fields (I have real time incoming data from the field)

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [November 19, 2019, 12:33pm UTC](https://discuss.elastic.co/t/geopoint-visualization-in-kibana-6-4-2-elastic-6-4-2/208468/7 "2019-11-19T12:33:18Z")

</div>

Hey, `update_by_query` will make sure the new data is indexed, so that should be fine.

One thing is standing out for me - it seems like `lon` and `lat` are strings instead of numbers. It doesn't have to be the case, but maybe they are not indexed correctly because of that. Could you try to make those values numbers specifically?

I just tried to create such a visualization locally and it works for me with data looking like this (note the missing quotes around the numbers):

 ![46](https://us1.discourse-cdn.com/elastic/original/3X/3/a/3ae4de5d97bfacd54f07820c261b451b42d25309.png)

---

<div class="post-metadata">

**Author:** ![samiujan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samiujan/32/23605_2.png) [@samiujan](https://discuss.elastic.co/u/samiujan)\
**Post date:** [November 19, 2019, 12:56pm UTC](https://discuss.elastic.co/t/geopoint-visualization-in-kibana-6-4-2-elastic-6-4-2/208468/8 "2019-11-19T12:56:56Z")

</div>

Thanks very much Joe

I will change the sub-fields to floats and test it out

---

<div class="post-metadata">

**Author:** ![samiujan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samiujan/32/23605_2.png) [@samiujan](https://discuss.elastic.co/u/samiujan)\
**Post date:** [November 20, 2019, 7:34am UTC](https://discuss.elastic.co/t/geopoint-visualization-in-kibana-6-4-2-elastic-6-4-2/208468/9 "2019-11-20T07:34:01Z")

</div>

So here is a postmortem of my efforts to correctly show geo\_point's in my visualization

1. I have real time data coming in through a REST API - this contains a "points" query param
2. The data is ingested by a filebeat plugin which sends it to logstash
3. Logstash's filter plugin parses and mutates it to an an object with 2 floating point values
4. Logstash's output plugin writes it to a filebeat index on ES
5. ES, Logstash and Kibana are all version 6.4
6. Filebeat indexes are created via a script and there is a new index every day e.g. for today's it's called filebeat-2019.11.20

So I finally did the following, **in order** for the geo\_point's to show up correctly

1. I updated the mapping to my latest filebeat by sending  
` curl -X PUT "localhost:9200/filebeat-2019.11.20/_mapping/doc?pretty" -H 'Content-Type: application/json' -d' { "properties": { "req_gp": { "type": "geo_point" } } } '`  
Please note I am using "doc" as the type name instead of "\_doc" since Logstash 6.4 auto creates a type called "doc" - the PUT Mapping reference for 6.4 on ES's official docs mention \_doc and updating the mapping for this type throws an error

`Rejecting mapping update to [<index_name>] final mapping would have more than 1 type: [_doc, doc]"`

1. Next I changed the field name in logstash's filter plugin:

I created a new field since you cannot change the mapping for an existing field in ES

Also, please note I created the mapping in the index **before** sending the data to this new field, otherwise ES would save the mapping as {float, float} for this field and again, it cannot be changed later

1. Lastly, I restarted Logstash

2. Updated the index pattern in Kibana and made sure only the field itself is listed with a "geopoint" type

3. Clicked "Visualize" next to the field name on the filter on the left and it showed up successfully in the Map Coordinates visualization

Later on I intend to all the new field mapping to previous indices and run update\_by\_query to move the existing data in the old indices to the new type in the same indices

P.S. Big thanks to Joe Reuter for helping out!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 18, 2019, 7:34am UTC](https://discuss.elastic.co/t/geopoint-visualization-in-kibana-6-4-2-elastic-6-4-2/208468/10 "2019-12-18T07:34:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.