Maps Unable to Load Tooltip Content

I've got a map using geo_point data to place coordinate markers on the map. When I add fields to the Tooltip, it displays Unable to load tooltip content: Unable to find document, _id:xxx when I hover over one of the coordinate markers on the map. If I do a search for the document id in Discover, I find it. Any idea why I'm seeing this?

Hey there Walker,

What version of Kibana are you using? I'm still looking into what might be going on here but it seems like in older versions of Kibana, there was a bug with how IDs that look like numbers get interpreted which might cause something like this

Latest and greatest, 7.7.0. I've seen the closed issues in GitHub and looked at the code changes and compared them to what was in the files I had, thinking maybe something got screwed up somewhere but its corrected in my code. Now, I AM specifying my own document id, is it possible that it doesn't like that for some reason?

Can you expand on what you mean by you're specifying your own document id?

Also, another thing that might be helpful to debug what's going on: If you open up the dev tools console in your browser and go to the network tab, when you hover over a point on the map, you should see a ES query request. If you grab that request, you can see exactly what the query that's being sent to ES is for that tooltip

1 Like

The events are ingested by logstash and during output, instead of letting logstash auto-generate an id for the event, I specify what the event id is going to be. My logstash config that generates the id is a hash of the message field, it may be completely irrelevant, but thought I would mention it. Below is the logstash config for it.

       fingerprint {
         source => "message"
         target => "[@metadata][fingerprint]"
         method => "MURMUR3"
       }

Below is one of the queries. Interestingly, the query has a match_phrase for index undefined. If i copy/paste the query into a filter under Discover, I get nothing. However, if I change the query from undefined to the correct index pattern, I get my results. Now the question is, how do I get it to not specify the index in the query and use the parameter specified further up in the request?

{
	"params": {
		"ignoreThrottled": true,
		"preference": 1591039671686,
		"index": "freeradius-*",
		"body": {
			"size": 1,
			"stored_fields": [
				"authentication.success",
				"client.location.city_name",
				"user.name"
			],
			"script_fields": {},
			"docvalue_fields": [],
			"_source": {
				"excludes": [
					"message*",
					"temp_message*",
					"@version*"
				],
				"includes": [
					"authentication.success",
					"client.location.city_name",
					"user.name"
				]
			},
			"query": {
				"bool": {
					"must": [],
					"filter": [
						{
							"bool": {
								"filter": [
									{
										"bool": {
											"should": [
												{
													"match_phrase": {
														"_id": "1081538035"
													}
												}
											],
											"minimum_should_match": 1
										}
									},
									{
										"bool": {
											"should": [
												{
													"match_phrase": {
														"_index": "undefined"
													}
												}
											],
											"minimum_should_match": 1
										}
									}
								]
							}
						}
					],
					"should": [],
					"must_not": []
				}
			}
		},
		"rest_total_hits_as_int": true,
		"ignore_unavailable": true,
		"ignore_throttled": true,
		"timeout": "30000ms"
	},
	"serverStrategy": "es"
}

Wow ok, found out how to fix the error, may want to look into changing this behavior.

Under Advanced Options>Meta Fields I changed it from the default _source, _id, _type, _index, _score to only _source, _id. Adding _index back into this option, the map tooltips now work. The reason for changing this option is, I have non-Elastic Stack technical people logging in and using Kibana. For these people these fields "muddy the waters" and make it more difficult for them to know what's relevant and what's not.

@poff, thanks for guiding me towards a resolution.

Excellent! Glad to hear it!

It does seem like we could update either the behavior of the Meta Fields editor or the maps tooltip query to better handle that. Thanks for the info!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.