Maps - how to add the terms aggregated right source to filters/tooltip?


I've created an index as a geometry look up table, containing the geojson for UK postcode districts (~3000 entires)

I now want to overlay data from a raw data file (various text and values for each district but no geometry, ~1million entries), by joining to the geometry index using the text of the district name in both indexes.

I can get something on screen with a terms aggregation join i.e using the geometry index as the layer (left source) then and binding the raw data (right source) in the terms aggregation.

However, none of the right source data is visible on the map in the tooltips nor is any of the raw data filterable. (I was hoping to use the Controls widget to make it filterable).

Is what I'm trying to do possible with Maps, and if not, is there a clever workaround?

Thanks in advance!

From the right you can only get aggregated metrics, counts, sums, averages, etc. This is a simple example (on 7.7) joining a countries and populated places datasets based on the country identifier.

On the other hand later you cannot filter in a dashboard based on the right index properties, like willing to filter the aggregations in the countries for cities with a minimum population. @Nathan_Reese can you please confirm if I am correct?

Following my example, the filter for the populated_places index from the Controls visualization ends up in the countries index, but I may be doing something wrong.


@ unclezoot, which version of kibana are you using?

In Kibana 7.6 and up, there are 2 settings that effect how global dashboard filters are applied to layers with joins

oooh thanks!!, now I finally get it, following my example now I can filter the right side of the join and change the result of the aggregation, I only had to disable that first switch :raised_hands:

Yup, that works.

I can now filter the right hand join after clearing the Global Filter slider.

Thank you Jorge and Nathan!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.