Region Map (Not showing any data if USED vector map and joined field)

[mark.quilates (Mr.M)]

Hi Guys,

Can help me solved my problem, I'm using ELK 6.2 and 6.3. I'm getting data once I filtered Region in China thru table but No data was showed if used region map.

Can help me how to solved this. Is there's any config should I need to do? Thanks

On KIbana 6.2 no data showed.

On Kibana6.3 getting these error

[thomasneirynck]

hi @mark.quilates,

that error looks like a bug. In any case, it should not happen, although. Could you log this as an issue (https://github.com/elastic/kibana/issues/new), with step-by-step instructions on how to reproduce?

As for the no-data, can you provide some sample data? How does your data-table look like? It's important that the join-field China administrative division codes exactly matches the field-values of that geoip.region_code field. I expect this is not the case. To see the field-values for all the layers, you can check https://maps.elastic.co/#file/China%20Provinces.

[mark.quilates (Mr.M)]

Hi @thomasneirynck,

Already logged issue encountered: Region Map (Not showing any data if used vector map and joined field) · Issue #22701 · elastic/kibana · GitHub

@thomasneirynck

As for the no-data, can you provide some sample data? How does your data-table look like? It's important that the join-field China administrative division codes exactly matches the field-values of that geoip.region_code field. I expect this is not the case. To see the field-values for all the layers, you can check Elastic Maps Service.

If I used, China administrative division codes and geoip.region_code: I encountered the Fatal Error.

While if I used, Province name (English) and geoip.region_name: The Guangxi Zhuang Autonomous Region, Ningxia Hui Autonomous Region and Inner Mongolia provinces had no data but, the rest of China regions were OK.

Since in my data, the name of the above regions are like these:

Guangxi
Ningsia Hui Autonomous Region
Inner Mongolia Autonomous Region

Is there a way to rename the said regions?

Below is the screenshot

[nickpeihl]

Hi @mark.quilates.

The best method for making the join is to create a scripted field in Kibana that concatenates the geoip.country_code2 and geoip.region_code fields.

Here is the code for the scripted field.

if (doc['geoip.region_code.keyword'].value != null && doc['geoip.country_code2.keyword'].value != null) {
  return  doc['geoip.country_code2.keyword'].value + '-' + doc['geoip.region_code.keyword'].value;
}
return "";

You may name the scripted field geoip.region_iso_code. Then you can create a Terms Aggregation on the geoip.region_iso_code field and select "ISO-3166-2 Identifier" as the Join Field in the Options tab.

The screenshots below show a region map created with Australia States.

You should also set a filter on the region map for geoip.country_code2.keyword is "CN" to limit the search to only China.

I also recommend you download the latest version of the MaxMind GeoIP 2 City database rather than the older one included with Logstash. You can specify the file location of the downloaded database in your Logstash config. Let us know if you have questions.

Also, thank you for opening the GitHub issue for the 6.3 error. We will review the error and update the issue when we find out why that is happening.

[mark.quilates (Mr.M)]

@nickpeihl,

Thanks for your help. However, I still don't see any data on my dashboard.

Seems ISO name differ from my data.

from the Region Map

Is there any way I can rename the below regions OR the ISO name?

Guangxi Zhuang Autonomous Region,
Ningxia Hui Autonomous Region and
Inner Mongolia provinces

Also, if can you try China Provinces from your end? If still working?
Because Australia State, works on my end.
But, China Provinces still not. Thanks!

[nickpeihl]

Hi @mark.quilates,

China Provinces works for me when I download and specify the latest MaxMind GeoLite2 database in Logstash. It looks like you may be using an older version of the GeoLite2 City database. The version of the GeoLite2 databases that come with Logstash are older versions which does not have the latest region codes for China. So you might need to use the latest GeoLite2 City database with Logstash to re-ingest your data again.

Alternatively, it may be possible to use a Painless scripted field to rename your data to match the region name. This example uses the Elvis operator to rename provinces if necessary. Then you may be able to use the new field to join to the English name.

doc['geoip.region_name.keyword'].value == 'Guangxi' ? 'Guangxi Zhuang Autonomous Region' : doc['geoip.region_name.keyword'].value == 'Ningsia Hui Autonomous Region' ? 'Ningxia Hui Autonomous Region' : doc['geoip.region_name.keyword'].value == 'Inner Mongolia Autonomous Region' ? 'Inner Mongolia' : doc['geoip.region_name.keyword'].value

Please note, province names may differ between versions of Logstash or GeoLite2 database. This is why I prefer to use the region codes.

You might also be interested in this blog post that was published today.

[mark.quilates (Mr.M)]

Hi @nickpeihl and @thomasneirynck

Thank you guys for your time and patience, to help me to solved my issue I have encountered in my Kinaba dashboard (China provinces map).

Its working and all good now. Thank you so much!

Cheers,

Mark