Geopoint visualization in Kibana 6.4.2 (Elastic 6.4.2)

Elastic Stack Kibana
6

Hi

I changed the logstash definition and sending a "lon" field - it does pick up the geopoint correctly and shows it that way in the "Discover" tab - but I still can't see it in the visualization

PFA screenshots of the geopoint datatype and its index mapping

qp_31
qp_31.png1077×235 9.76 KB
qp_3
qp_3.png1328×480 19.7 KB

Following is the request response

Request

{
  "aggs": {
    "filter_agg": {
      "filter": {
        "geo_bounding_box": {
          "ignore_unmapped": true,
          "qp_points": {
            "top_left": {
              "lat": 90,
              "lon": -180
            },
            "bottom_right": {
              "lat": -90,
              "lon": 180
            }
          }
        }
      },
      "aggs": {
        "3": {
          "geohash_grid": {
            "field": "qp_points",
            "precision": 2
          },
          "aggs": {
            "4": {
              "geo_centroid": {
                "field": "qp_points"
              }
            }
          }
        }
      }
    }
  },
  "size": 0,
  "_source": {
    "excludes": []
  },
  "stored_fields": [
    "*"
  ],
  "script_fields": {},
  "docvalue_fields": [
    {
      "field": "@timestamp",
      "format": "date_time"
    }
  ],
  "query": {
    "bool": {
      "must": [
        {
          "match_all": {}
        },
        {
          "range": {
            "@timestamp": {
              "gte": 1574165051943,
              "lte": 1574165351943,
              "format": "epoch_millis"
            }
          }
        },
        {
          "match_phrase": {
            "apikey.keyword": {
              "query": "<apikey>"
            }
          }
        }
      ],
      "filter": [],
      "should": [],
      "must_not": []
    }
  }
}

Response

{
  "took": 51,
  "timed_out": false,
  "_shards": {
    "total": 720,
    "successful": 705,
    "skipped": 700,
    "failed": 0
  },
  "hits": {
    "total": 307,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "filter_agg": {
      "3": {
        "buckets": []
      },
      "doc_count": 0
    }
  },
  "status": 200
}

Should I just use a new field altogether?

Also, Joe when you say "re-index existing data" I expect I need to run the update_by_query and delete_by_query commands to clean up the existing data fields (I have real time incoming data from the field)