Not getting my geo_point

Elastic Stack Elasticsearch
1

Hi ! (Previously opened this issue in kibana forum, but I found it look more like ES problem after couple of debugging steps. Kibana not plotting my Geo_point)

so here is my mapping for my index

    "mappings": {
      "geoip": {
        "properties": {
          "geoip": {
            "properties": {
              "location": {
                "type": "geo_point"
              }
            }
          }
        }
      }
    },

I'm getting data (from geoip logstash plugin) and it look like the are good:
Capture

the Es query look good to me

    {
      "aggs": {
        "filter_agg": {
          "filter": {
            "geo_bounding_box": {
              "ignore_unmapped": true,
              "geoip.location": {
                "top_left": {
                  "lat": 90,
                  "lon": -180
                },
                "bottom_right": {
                  "lat": -90,
                  "lon": 180
                }
              }
            }
          },
          "aggs": {
            "2": {
              "geohash_grid": {
                "field": "geoip.location",
                "precision": 2
              },
              "aggs": {
                "3": {
                  "geo_centroid": {
                    "field": "geoip.location"
                  }
                }
              }
            }
          }
        }
      },
      "size": 0,
      "_source": {
        "excludes": []
      },
      "stored_fields": [
        "*"
      ],
      "script_fields": {},
      "docvalue_fields": [
        {
          "field": "@timestamp",
          "format": "date_time"
        }
      ],
      "query": {
        "bool": {
          "must": [
            {
              "range": {
                "@timestamp": {
                  "gte": 1551452442418,
                  "lte": 1551453342418,
                  "format": "epoch_millis"
                }
              }
            }
          ],
          "filter": [
            {
              "match_all": {}
            },
            {
              "match_all": {}
            }
          ],
          "should": [],
          "must_not": []
        }
      }
    }

but it return not result ( i checked that I had data in the time period)

{
  "took": 10,
  "timed_out": false,
  "_shards": {
    "total": 10,
    "successful": 10,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 351,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "filter_agg": {
      "2": {
        "buckets": []
      },
      "doc_count": 0
    }
  },
  "status": 200
}

I'm I missing something / any idea on what next I can do to troubleshoot this ?

many thanks

2

Please format your code, logs or configuration files using </> icon as explained in this guide and not the citation button. It will make your post more readable.

Or use markdown style like:

```
CODE
```

This is the icon to use if you are not using markdown format:

image
image.jpg764×92 16.4 KB

There's a live preview panel for exactly this reasons.

Could you provide a full recreation script as described in About the Elasticsearch category. It will help to better understand what you are doing. Please, try to keep the example as simple as possible.

A full reproduction script will help readers to understand, reproduce and if needed fix your problem. It will also most likely help to get a faster answer.

3

Hi dadoonet, thx for the info, I updated the initial post with proper formatting.
As for the script, im not sure what to provide else then the mapping used to create the index and the ES seach query and answer. Any other step would help?

4

As for the script, im not sure what to provide else then the mapping used to create the index and the ES seach query and answer. Any other step would help?

What would help is a script that:

  • delete the index
  • create the index with mapping
  • index a document
  • run a search

This script can be then just copied and paste in Kibana dev console so we can just run it and see. Exactly what is described in About the Elasticsearch category

5

Here a script with all the steps:

  • delete the index
DELETE syslo
  • create the index with mapping
    PUT syslo
    {
        "mappings": {
          "geoip": {
            "properties": {
              "geoip": {
                "properties": {
                  "location": {
                    "type": "geo_point"
                  }
                }
              }
            }
          }
        }
    }
  • index a document
    PUT syslo/geoip/1
    {
    "geoip": {
          "city_name": "Québec",
          "country_name": "Canada",
          "longitude": -71.2453,
          "ip": "52.111.11.111",
          "continent_code": "NA",
          "latitude": 46.7933,
          "country_code2": "CA",
          "location": {
            "lat": 46.7933,
            "lon": -71.2453
          }
      }
      
    }
  • run a search
    GET syslo/_search
    {
      "aggs": {
        "filter_agg": {
          "filter": {
            "geo_bounding_box": {
              "ignore_unmapped": true,
              "geoip.location": {
                "top_left": {
                  "lat": 90,
                  "lon": -180
                },
                "bottom_right": {
                  "lat": -90,
                  "lon": 180
                }
              }
            }
          },
          "aggs": {
            "2": {
              "geohash_grid": {
                "field": "geoip.location",
                "precision": 2
              },
              "aggs": {
                "3": {
                  "geo_centroid": {
                    "field": "geoip.location"
                  }
                }
              }
            }
          }
        }
      },
      "size": 0,
      "_source": {
        "excludes": []
      },
      "stored_fields": [
        "*"
      ],
      "script_fields": {},
      "docvalue_fields": [
        {
          "field": "@timestamp",
          "format": "date_time"
        }
      ],
      "query": {
        "bool": {
          "must": [
            {
              "range": {
                "@timestamp": {
                  "gte": 1551794528266,
                  "lte": 1551796328266,
                  "format": "epoch_millis"
                }
              }
            }
          ],
          "filter": [
            {
              "match_all": {}
            },
            {
              "match_all": {}
            }
          ],
          "should": [],
          "must_not": []
        }
      }
    }

please let me know if something seems wrong in my script

6

That is not matching any date:

      "must": [
        {
          "range": {
            "@timestamp": {
              "gte": 1551794528266,
              "lte": 1551796328266,
              "format": "epoch_millis"
            }
          }
        }
      ],

Then running that:

GET syslo/_search
{
  "aggs": {
    "filter_agg": {
      "filter": {
        "geo_bounding_box": {
          "ignore_unmapped": true,
          "geoip.location": {
            "top_left": {
              "lat": 90,
              "lon": -180
            },
            "bottom_right": {
              "lat": -90,
              "lon": 180
            }
          }
        }
      },
      "aggs": {
        "2": {
          "geohash_grid": {
            "field": "geoip.location",
            "precision": 2
          },
          "aggs": {
            "3": {
              "geo_centroid": {
                "field": "geoip.location"
              }
            }
          }
        }
      }
    }
  }
}

Is giving some result:

{
  "took" : 21,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 1,
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "syslo",
        "_type" : "geoip",
        "_id" : "1",
        "_score" : 1.0,
        "_source" : {
          "geoip" : {
            "city_name" : "Québec",
            "country_name" : "Canada",
            "longitude" : -71.2453,
            "ip" : "52.111.11.111",
            "continent_code" : "NA",
            "latitude" : 46.7933,
            "country_code2" : "CA",
            "location" : {
              "lat" : 46.7933,
              "lon" : -71.2453
            }
          }
        }
      }
    ]
  },
  "aggregations" : {
    "filter_agg" : {
      "doc_count" : 1,
      "2" : {
        "buckets" : [
          {
            "key" : "f2",
            "doc_count" : 1,
            "3" : {
              "location" : {
                "lat" : 46.79329996928573,
                "lon" : -71.2453000433743
              },
              "count" : 1
            }
          }
        ]
      }
    }
  }
}

Not sure if this is what you meant.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.