Issues in Kibana 4.1 tutorial tile map visualization: no time window selector, no geo_point compatible field

Elastic Stack Kibana
#1

Hi,

I'm working through https://www.elastic.co/guide/en/kibana/4.1/tutorial-visualizing.html and I'm hitting a divergence from the tutorial.

I can see the log data in the indices matching logstash-2015.05* when I browse in Discover, and I can see the schema under settings.

When I start the tutorial section "Next, we’re going to make a tile map chart...", I have the following issues:

  • I don't see time selector the tutorial says should be in the upper right. It's just a black bar.
  • I'm getting an error "No Compatible Fields: The "logstash-2015.05*" index pattern does not contain any of the following field types: geo_point" when I try the GeoCoordinates bucket.

Have I missed a step or set something incorrectly?

Thanks,
-Scott

For reference, here's the schema shown under Settings for the logstash-2015.05* index pattern:

referer
string

agent
string

relatedContent.og:type
string

relatedContent.og:image:width
string

relatedContent.og:description
string

geo.dest
string

relatedContent.twitter:image
string

geo.coordinates.lon
number

relatedContent.twitter:card
string

utc_time
date

clientip
string

relatedContent.og:image:height
string

host
string

machine.ram
number

links
string

phpmemory
number

geo.coordinates.lat
number

ip
string

relatedContent.og:image
string

relatedContent.article:modified_time
date

relatedContent.url
string

relatedContent.article:tag
string

spaces
string

headings
string

_source
_source

1 Like
#2

It's because the geo data hasn't been mapped as a proper geo point, and I can't see a combined point in your mappings either.

Do you have a geoip.location field?

#3

Not that I see. I'm using the data set provided at a link in the tutorial. Seems like a cruel trick to play n a "Your First Ten Minutes With..." walk through. /:frowning:

#4

@Scott_Brown I'm really sorry about the bad experience with this tutorial :frowning:

We only discovered this issue recently and are working on fixing that: https://github.com/elastic/kibana/issues/4448

1 Like
#5

Mr. Brown:

Sorry for your bad experience with the tutorial! With current versions of Elasticsearch, this dataset needs a geolocation mapping to work properly.

To clear the data from a previous import, execute the following commands:

curl -XDELETE http://localhost:9200/logstash-2015.05.18
curl -XDELETE http://localhost:9200/logstash-2015.05.19
curl -XDELETE http://localhost:9200/logstash-2015.05.20

Before importing the logs.jsonl file to Elasticsearch, establish the mappings with the following command:

curl -XPUT http://localhost:9200/logstash-2015.05.18 -d '
{
"mappings" : {
"log" : {
"properties" : {
"geo" : {
"properties" : {
"coordinates" : {
"type" : "geo_point"
}
}
}
}
}
}
}
';

Repeat that mapping for the other two dates, 2015-05-19 and 2015-05-20, then import logs.jsonl according to the tutorial's instructions.

You may need to refresh your indexes by navigating to Settings > Indices in the Kibana UI, selecting the logstash-* index pattern, and clicking the yellow Refresh button.

I'll update the documentation to reflect this step soonest.

Paul Echeverri
Senior Technical Writer

1 Like
#6

Thanks folks, glad it's getting updated. Remember to always test the documentation too! :smile:

1 Like
#7

Awesome! I've just encountered this problem too, thanks for your help :smile:

1 Like
#9

Hi Paul,

Should it be "coordinates" or "location". The ES 2.0 documentation says that it should be "location".

Thanks,
Zak

#10

Zak:

I'm in the process of revising the tutorial to work with ES2.0 and I'll be sure to resolve this. I'll update you when the new doc posts.

Paul E.

#11

Mr. Siddiqui:

https://github.com/elastic/kibana/pull/5354 updates the Tutorial. That part of the mapping is an arbitrary label, and you can call it whatever you like as long as it's consistent with your data set. In any case, stricter mapping requirements in ES2.0 have resulted in updated mappings and this one is no longer correct.

Best,
Paul E.

#12