Hello everyone,
I am having trouble viewing points in my kibana map, It says No results found , I have made sure of the timestamps and that the data is in geo.point format, so I have no clue what the problem could be. below is an image of the problem and the data in discover.
The mapping is number and not geo_point. You can see that based on the icon as a #. The mapping is the important part for Maps to recognize it, not the data itself.
Here is what the icon looks like for geo.
Hello, Thank you for replying the longitude and latitude are numbers however the location itself is a geo_point, Should I change the lan and lat to be geo_point as well?
This is what shows up when I select a field
Anything you plan on using in Maps needs to have a geo_point mapping, yes.
@rana5 you can debug the requests that the Maps app performs using the Inspect link.
In 7.12:
In the inspector interface you can get there the exact request the app is doing, along with the results.
Finally, you can copy the request and execute it in the Console Dev Tools to check by yourself the results returned by Elasticsearch
Hope this helps!
Hello, Thank you for replying ,I think I figured out the problem but I dont know how to fix it.
Below is my mapping (I collapsed some fields and omitted others)
{
"so-import-2021.01.20":{
"mappings":{
"dynamic":"false",
"dynamic_templates":[],
"date_detection":false,
"properties":{
"destination":{
"dynamic":"true",
"properties":{
"geo":{
"properties":{
"city_name":{},
"continent_name":{},
"country_iso_code":{},
"country_name":{},
"ip":{},
"location":{
"properties":{
"lat":{
"type":"float"
},
"lon":{
"type":"float"
}
}
},
"region_iso_code":{},
"region_name":{},
"timezone":{}
}
},
"ip":{},
"port":{}
}
},
"destination_geo":{
"dynamic":"true",
"properties":{
"ip":{
"type":"ip"
},
"latitude":{
"type":"half_float"
},
"location":{
"type":"geo_point"
},
"longitude":{
"type":"half_float"
}
}
},
}
}
}
}
And in the inspect tab it request the destination_geo.location (with an underscore) which my data is in destination.geo.location (however this field isnt a geo_point) Found below:
{
"docvalue_fields": [
"destination_geo.location"
],
"size": 10000,
"_source": false,
"script_fields": {},
"stored_fields": [
"destination_geo.location"
],
"query": {
"bool": {
"must": [],
"filter": [
{
"match_all": {}
},
{
"geo_bounding_box": {
"destination_geo.location": {
"top_left": [
-180,
89
],
"bottom_right": [
180,
-89
]
}
}
},
{
"range": {
"@timestamp": {
"gte": "2020-05-04T12:19:37.918Z",
"lte": "2021-05-04T12:19:37.918Z",
"format": "strict_date_optional_time"
}
}
}
],
"should": [],
"must_not": []
}
}
}
SO now my question is how Do I update the mapping? I keep getting errors when trying to update it.
You can't just change mapping unfortunately. So most just do the process below.
Easiest way is to create a new index. Then reindex your data to that index.
Create your index back with the correct mapping. Then reindex your data back to the original with the correct mapping.
Then delete your temporary index.
1 Like
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.