Region Map not showing all results

[mmisztal1980 (Maciek Misztal)]

Hi all, I'm using a dockerized Elastic Stack v 6.5.3.

My Kibana container has been configured to use the regionmap:

regionmap:
 layers:
  - name: "Warsaw Districts"
    url: "https://realmdevstrg.blob.core.windows.net/json/pl-warsaw-geojson.json"
    fields:
     - name: "name"
       description: "Name"
     - name: "regionId"
       description: "Region.Id"

Please note that in the above, the regionId is the field I use for joining.

I've got a business process that does some work and emits results for each of the regions, here is a saved search result (middle column is the join field), containing 16 regional results:

I've created a region map, using the above saved search visualization and set the join field to the middle column of the saved search. The aggregated value is an average of the right-hand side column.

Having enabled the region map I've noticed that only 5/16 regions are displayed. I've verified the saved search results and the contents of the geojson file (see config). Can you tell me what is wrong, eventually how to diagnose this?

[Nathan_Reese]

Click inspect button in the top navigation. This will display the terms aggregation request. The results of the request are used to perform the join with the geojson file in the browser. What does the response look like? Does it contain a bucket for each of the 16 districts?

[mmisztal1980 (Maciek Misztal)]

Hi @Nathan_Reese , thanks for responding.

It appears that the join result only contains 5 districts.

Request:

{
  "aggs": {
    "2": {
      "terms": {
        "field": "fields.AllSubRegionSearchesCompleted.SubRegion.Id.keyword",
        "size": 5,
        "order": {
          "1": "desc"
        }
      },
      "aggs": {
        "1": {
          "avg": {
            "field": "fields.AllSubRegionSearchesCompleted.Count"
          }
        }
      }
    }
  },
  "size": 0,
  "version": true,
  "_source": {
    "excludes": []
  },
  "stored_fields": [
    "*"
  ],
  "script_fields": {},
  "docvalue_fields": [
    {
      "field": "@timestamp",
      "format": "date_time"
    },
    {
      "field": "fields.Timestamp",
      "format": "date_time"
    }
  ],
  "query": {
    "bool": {
      "must": [
        {
          "match_all": {}
        },
        {
          "query_string": {
            "query": "AllSubRegionSearchesCompleted",
            "analyze_wildcard": true,
            "default_field": "*"
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": 1546267206890,
              "lte": 1546269006890,
              "format": "epoch_millis"
            }
          }
        }
      ],
      "filter": [],
      "should": [],
      "must_not": []
    }
  },
  "highlight": {
    "pre_tags": [
      "@kibana-highlighted-field@"
    ],
    "post_tags": [
      "@/kibana-highlighted-field@"
    ],
    "fields": {
      "*": {}
    },
    "fragment_size": 2147483647
  }
}

Response:

{
  "took": 18,
  "timed_out": false,
  "_shards": {
    "total": 25,
    "successful": 25,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 16,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "2": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 11,
      "buckets": [
        {
          "1": {
            "value": 3026
          },
          "key": "146505-8",
          "doc_count": 1
        },
        {
          "1": {
            "value": 1644
          },
          "key": "146518-8",
          "doc_count": 1
        },
        {
          "1": {
            "value": 1335
          },
          "key": "146507-8",
          "doc_count": 1
        },
        {
          "1": {
            "value": 1120
          },
          "key": "146513-8",
          "doc_count": 1
        },
        {
          "1": {
            "value": 889
          },
          "key": "146502-8",
          "doc_count": 1
        }
      ]
    }
  },
  "status": 200
}

This is weird. If you examine the geojson under the link, you'll see that the regionId property is attached to each region Why might be the join failing?

[mmisztal1980 (Maciek Misztal)]

@Nathan_Reese I think I've found it, in the Request, the size defaults to 5. This solves the issue.