Kibana Maps

Elastic Stack Kibana
1

Hi. I created some Maps in in ES/Kibana 6.x and added Data Layers from Documents (Index). All good so far. Then i tried to create another Map but wanted to use a different Document Source (Index) but it only shows one Index (the default Index).

I thought it might be a limitation of 6.x as Maps where Beta in 6.x and upgraded to 7.x but i have the same situation after update. Example:

grafik

Why can i only choose only the one index pattern? Is it possible to have another index? Do i made a mistake somewhere?

2

Hello Maik,

You need to ingest indices into elasticsearch, create index patterns and then they will show up here under documents.

Also do you have permissions on all your indices?

Let me know if this doesn't help you.

Thanks,
Bhavya

3

Hi Bhavya,

i have douzens of indexes in elastic search and i have at least 9 index patterns in kibana.

grafik
grafik.png333×619 12.4 KB

as i said, just the default index shows up in maps layer:

grafik
grafik.png788×242 51.4 KB

and as far as i can say i have full permissions on all the indices...

4

Interesting. Will investigate a bit more and keep you posted.

Thanks,
Bhavya

5

Ok so this isn't happening in my local. Can you please tell me which is your stack version?

cc @Aaron_Caldwell can we please get some help here?

Thanks,
Bhavya

6

Hello,

I'm also curious to hear your stack version.

One other question, are you absolutely certain your indexes contain properly formatted geospatial data? It might be worth double-checking your mappings. If your data wasn't explicitly mapped as a geo field, the data could be mapped as text or integer depending on its format, and wouldn't be detected as geo data by the Maps app.

Regards,
Aaron

7

Stack:

Kibana 7.4.2
Elasticsearch 7.4.2

I believe you have a hit. I compared my mappings of Geo Data und only in the one i can choose its correctly mapped as far as i can rate...I keep you informed.

1 Like
8

Aaron, Bhavya,

thanks for your help. Aaron you pointed me to the solution. The mapping was not done because there are mapping changes since logstash 6 and 7 and my mapping couldnt be installed to elastic. i read the docs for 7 and rearranged my mapping template and ist working now.

If its useful for somebody the only thing needed to be done was removing a line in mappings

(note that this worked perfect under 5/6 of logstash):

grafik

1 Like
9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.