Help with circle colors on elastic maps

[richardchin]

Hi - I am a newbie to elasticsearch and maps, so sorry if this is an obvious question but I cannot seem to find much info on detailed examples. This is my issue:
I am trying to visualise the status of our HW units around the US on a map, with a colored circle representing the status of each unit. Colors indicate status: Green="working", Amber="unknown", Red="not working". I have managed to get it working by mapping a number 0,1 or 2 to a numeric status field returned by each unit and then using a Document Query layer on the map. This works - I get colored circles for each unit.

The problem is that several units may have the same location, which maps then seems to aggregate - when I hover over a point I see there are a number of "features" at that point. That is fine, but I need the colored circle to show the worse-case state of any of these aggreagted units i.e. the unit with the highest numbered state and color the circle accordingly. So, for example, if 4 units have been aggregated and there are 3 working and 1 not-working, I want the circle color to be red. But so far, the selected color seems to be randomly selected amongst the returned results so in this example, may be green or red.

Is there a way to construct a query in maps to do this? Or, is there a way to use multiple layers to achieve something similar? I have tried to use the latter approach, with a different filter for each layer, but I cannot seem to get it to accept a layer -specific filter, it ignores my filter even after I have clicked "Set Filter" (that is another problem...).

[jsanz (Jorge Sanz)]

Hi Richard,

I see two ways to solve your use case:

1. use the grid aggregation source using points and the finest resolution, and then aggregate using the maximum of your field. That has the problem of having your geometries also displaced, but depending on the number of documents it may be your only solution anyways.

2. If you are not rendering more than 10K records at a time and you can wait for 7.5, then you will benefit from the new sorting method merged here.

Let us know if this makes sense to you.

Cheers!
Jorge

[Nathan_Reese]

The problem is that several units may have the same location, which maps then seems to aggregate

Features occurring at the same location are not aggregated, they are stacked. So you are only seeing the top feature at a location.

I think the best way to solve this would be to use multiple layers to display your data set. Create a layer for each category. Then apply a filter to each layer to filter the data set for each category, for example "status : 0" Finally, use drag and drop in the map legend to order the layers in the legend so that "Not working" is on top. See Vector styling | Kibana Guide [8.11] | Elastic for more details.

Also set the layer transparency to a value less then 100% so you can see when features are stacked on top of each other.

[richardchin]

Using layers does mainly solve the issue - thanks - elasticmaps is certainly a great tool! One issue that I still have is I am setting "Show most recent documents by entity" so that I only get the most recent status, butit seems that the layer-filter is being applied before this, so I get the last not-working status even if there is a more recent working status reported for this unit. Is there a way to apply a global filter (ideally for the entire dashboard) that will filter for most recent results in a given field, before any other filters are applied?

The new sorting method in 7.5 could also help on this possibly, as long as there is a way to specify the order of the filters.