Kibana 5.3.1 Tilemap issue

[mmdallal (mohammad almodallal)]

Hello,

I'm collecting Netflow data from Palo Alto NGFW, using Logstash and Elasticsearch, but Kibana unable to show Tilemap or graphs for Locations and giving numbers but (-) instead of city or location.

I'm using 5.3.1 for all software nitems on Oracle Linux 7.3

any help?

Thanks.

[rashmi (kulkarni)]

Hi

I'm having a hard time visualizing exactly what's happening. Could you provide some screenshots or perhaps an animated gif to show what's going on? As as an alternative, can you also look at your field mappings? location type in your mapping should be geo_point to see the maps.
Also, you could index a sample data which contains geo_location and try it first to see if you can create a visualization with Tile map.

https://www.elastic.co/guide/en/kibana/current/_configuration.html

Thanks
Rashmi

[mmdallal (mohammad almodallal)]

Hi,
actually it is an empty MAP just the grey one

for the configuration file

input {
udp {
port => 9995
codec => netflow {
versions => [5, 9, 10]
}
type => netflow
}
}
filter {
geoip {
source => "[netflow][ipv4_src_addr]"
target => "src_geoip"
}
geoip {
source => "[netflow][ipv4_dst_addr]"
target => "dst_geoip"
}
mutate {
convert => {
"[netflow][ipv4_src_addr]" => "string"
"[netflow][ipv4_dst_addr]" => "string"
}
convert => { "longitude" => "float" }
convert => { "latitude" => "float" }
convert => { "location" => "float" }
}
}
output {
elasticsearch {
hosts => [ "xxxxxx:9200" ]
}
}

Thanks.

[rashmi (kulkarni)]

Hi

It seems to me that the configuration is not yet selected. Can you plz select the "geo coordinates" button, select the geo-field and press the play button?
Do let us know what happens.

Thanks
Rashmi

[mmdallal (mohammad almodallal)]

Hi,

I modified it but unfortunately it gives me a white page.
can you send me a configuration for logstash (Input, Output, ....)?

Thanks.

[rashmi (kulkarni)]

cc @thomasneirynck : can you please help this discuss user ?

Many Thanks
Rashmi

[thomasneirynck]

Hi @mmdallal,

can you attach a screenshot of the page with the geo_coordinates selected, after pressing the play-button?

Can you also expand the data-table (using the little grey arrow near the bottom of the map), and show the request/responses to Elasticsearch?

thx,