Kibana Maps Issue

Elastic Stack Kibana
1

Are there any limitations with the geoip.location field and Maps?

I have an index that has login data (originally from csv data) with geoip.location. If I look at the index using discover (and the original csv using Excel for instance) I can see current (as in today) logins but when using Maps the data points are not up to date. (perhaps missing by more than a week)
I have tried a variety of date format types (absolute/relative etc) and in the inspector I can see current responses (for today) but the map point has a date of over a month ago for another data point from the index.

So to sum up - the index has all the latest entries but Maps is not displaying the up to date data points (map is partially populated)

I understand this is Beta but just wondered if there is something I am missing?

Regards

Ed

2

I'm not aware of any limitations with the Maps app with respect to the geoip.location field.

This is unlikely, but one thing we have noticed is that Discover will sometimes perform an index pattern refresh, so if you were on Discover after Maps, then you might have seen data that Maps wasn't aware of at the time. But if you navigate from Discover -> Maps, and still don't see the data, then this isn't the underlying problem.

Is it possible to get a copy of the CSV (perhaps with redacted/dummy user info) along with a copy oc the index mapping so that I can try to reproduce this for you?

3

Many thanks for the reply, I have redacted the CSV and as a test re-imported and tested again with Maps showing different hit return count and still no up to date map point for a specific csv field.
Will message you the csv directly, is that ok?

Regards

Ed

4

Yep, a direct message with the CSV would be perfect. If you could also include the steps you used to import the CSV, that would be helpful too. Otherwise, I'll just import it as I see fit.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.