Is there any way to find the "xxx" that produces the most geo data？

[wajika]

I did not find the visitor information for this location in Zhengzhou in the city list.

I want to find out the "XX" serivce traffic information corresponding to geo_localtion.

serive.name geo_localtion
xxxx 113.11111,22.1111

The data source is kubernetes ingress.

mapping
https://paste.ubuntu.com/p/qWqGNrggbf/

[warkolm (Mark Walkom)]

That's definitely possible, have you tried an aggregation on the geoip.location field?

[wajika]

The geoip.location field cannot be used as an aggregation condition.

I tried several methods, but the amount of data displayed is very different from the amount on the map.

[Nathan_Reese]

@wajika

Thanks for posting your question. Can you describe your use case more? What are you looking for in the table on the right of the map? Could this problem be better solved with drilldowns, allowing you to link into a dashboard with the context of a specific IP address? Are you just looking for the latest documents for this IP address? Would showing raw documents help?

[wajika]

@Nathan_Reese
Sorry, I did not express it clearly.
The problem I encountered was that I found that my visitor information (geo) was incorrectly displayed on the map, and the largest mark on the map did not match the actual location of my customer. I want to find out the reason, but the geo_localtion field cannot be queried as an aggregation condition.
I want to know if the elastic team has a better way to pinpoint this anomaly.