Index not listed only when trying to add a map

Hello,

Kibana has well identified my index (ims_cyber_logs). I can see the logs in Discover and build some classic visualization like bar, char, area..

But when I try to build a map, and specifically by selecting a source like Documents or Grid Aggregation, my index is not listed. There is only the Kibana data sample logs:

index_nok

What is strange is I can build a Vector Shape like World Countires, and in the "Terms join" section, I can select my index as you can see here :

Index is fresh. As I can see my index in a specific place and not in another I don't understand this behavior.

Would you have some ideas to figure this out ?

Thank you !

But when I try to build a map, and specifically by selecting a source like Documents or Grid Aggregation, my index is not listed. There is only the Kibana data sample logs :slight_smile:

The Index pattern for Documents only shows index patterns with a field mapped as geo_point or geo_shape.

You can look in the documentation for more details at https://www.elastic.co/guide/en/kibana/master/vector-layer.html

How is your geospatial data indexed? Did you index the field as geo_point or geo_shape?

Indeed I don't have these fields.... I think this is because I use custom template

So I had to create a new template to have geopoint field :

 PUT /_template/ims_ilm_template
{
  "index_patterns": ["ims_cyber_logs-*"], 
  "settings": {
    "number_of_shards": 3, 
    "number_of_replicas": 1,
	"index.lifecycle.name": "ims_ilm_policy",      
    "index.lifecycle.rollover_alias": "ims_cyber_logs",
    "index.routing.allocation.include.box_type": "hot"
  }, 
    "mappings" : {
      "properties" : {
        "geoip" : {
          "dynamic" : true,
          "properties" : {
            "ip" : {
              "type" : "ip"
            },
            "latitude" : {
              "type" : "half_float"
            },
            "location" : {
              "type" : "geo_point"
            },
            "longitude" : {
              "type" : "half_float"
            }
          }
        },
        "@version" : {
          "type" : "keyword"
        }
      }
    }
}

Thanks a lot for your help @Nathan_Reese ! :grinning:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.