Kibana dashboard map layer tooltip shows array instead of individual field

Elastic Stack Kibana
1

Good afternoon all,

I've checked the forums to see if there was a similar issue to this, but was not able to find any besides this regarding supporting nested field in maps

Mapping

{
  "mappings": {
    "properties": { 
        "features": {
          "properties": {
            "geometry": {
              "properties": {
                "coordinates": {
                  "type": "geo_point"
                }
              }
            },
            "pointId": {
              "type": "text"
            }
          }
        }
      }
    }
}

Data Sample

{
	"type": "FeatureCollection",
		"features": [
			{
				"type": "Feature",
				"geometry": {
					"type": "Point",
					"coordinates": [-100.66, 45.05]
				},
				"pointId": "name1"
			},
			{
				"type": "Feature",
				"geometry": {
					"type": "Point",
					"coordinates": [-150.90, 34.35]
				},
				"pointId": "name2"
			},
			{
				"type": "Feature",
				"geometry": {
					"type": "Point",
					"coordinates": [-110.67, 47.33]
				},
				"pointId": "name3"
			}
		]
}

Using the Documents map layer I then set Tooltip fields to features.pointId however, if you refer to the image below, it displays an array of the names.

tooltip
tooltip1695×727 123 KB

What I am trying to achieve is have the tooltip display individual property fields for each point? Been trying to read through the nested fields documentation, but I was unable to find much documentation when it came to the maps aspect.

2

For what it is worth, I have also tried updating the mapping so the feature field is of "type" : "nested". The issue there however is that, while functional, the geo_point reference is lost and now the document is not recognized as containing a geo field.

Might be an error in the mapping on my part, but I'm currently playing with the input to see if I can get it to work with the nested declaration. Will update the post with the results shortly.

UPDATE

Have been unable to get get nested fields to be recognized as a geo field for viewing on a map layer. Based on this comment [Maps] support nested fields with geo_point · Issue #35135 · elastic/kibana · GitHub it appears maps do not, as of 2020/09/28, support nested fields. Not sure if this is still true, but if so, is there a way to be able to achieve the result of the original post?

Forgot to include the versions, but in case anyone is curious I'm using 8.5.1 for both Elasticsearch and Kibana.

3

As @Nathan_Reese mentioned on that linked comment, the Maps application does not support nested fields.

You need to modify your process to work directly on your GeoJSON, ingesting individual features instead of a singe document containing the complete dataset.

Unfortunately it is not possible to split a single document into several ones inside Elasticsearch through an ingest pipeline as discussed here so you need to do this before ingest.

Sorry for the inconvenience.

4

Jorge,

Thank you for the follow up and confirmation regarding nested fields. It's only a few more lines of code to break apart the nested geo_point objects and setting up Logstash to do bulk outputs of data to Elasticsearch, in a way, is similar to sending them all as a nested object. Would have been nice to be able to handle nested fields, but it really isn't that much harder to have a "query ID" that links the individuals events.

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.