# Security Onion - Kibana - Unable to load tooltip content in Maps **URL:** \ **Category:** Kibana\ **Created:** [July 25, 2022, 12:16pm UTC](https://discuss.elastic.co/t/security-onion-kibana-unable-to-load-tooltip-content-in-maps/310535 "2022-07-25T12:16:09Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![DigitalDick](https://avatars.discourse-cdn.com/v4/letter/d/a9a28c/32.png) [@DigitalDick](https://discuss.elastic.co/u/DigitalDick)\ **Post date:** [July 25, 2022, 12:16pm UTC](https://discuss.elastic.co/t/security-onion-kibana-unable-to-load-tooltip-content-in-maps/310535/1 "2022-07-25T12:16:09Z")
Hi, New here and new to Kibana. Any help greatly appreciated. So I have setup Security Onion 2.3, I am using netflow to send logs from Meraki to Security Onion. I can see the logs, I can see the dots on the maps etc. When i come to do a document add in, and all the tooltip option so i can view what clients are accessing certain area's ( i assume thats how it works) I get a box up that says "unable to load tool tip content" its states Unable to find document\_id I have no idea where to look or what to change without breaking something. Can anyone help? Thanks ---
**Author:** ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)\ **Post date:** [July 25, 2022, 1:57pm UTC](https://discuss.elastic.co/t/security-onion-kibana-unable-to-load-tooltip-content-in-maps/310535/2 "2022-07-25T13:57:43Z")
What version of Kibana are you running? Can you show how your map layer is configured? ---
**Author:** ![DigitalDick](https://avatars.discourse-cdn.com/v4/letter/d/a9a28c/32.png) [@DigitalDick](https://discuss.elastic.co/u/DigitalDick)\ **Post date:** [July 25, 2022, 2:14pm UTC](https://discuss.elastic.co/t/security-onion-kibana-unable-to-load-tooltip-content-in-maps/310535/3 "2022-07-25T14:14:31Z")
Hi, Not sure how to get that info so i have upladed a screen shot? ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/9/e91326291ea3971eea7f28a0382bded7bddd26f9.jpeg) The Kibana version is v 8.3.2 if im reading that from within Elastic? How else can i tell the version of Kibana? Thanks for your help so far 🙂 ---
**Author:** ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)\ **Post date:** [July 26, 2022, 12:37am UTC](https://discuss.elastic.co/t/security-onion-kibana-unable-to-load-tooltip-content-in-maps/310535/4 "2022-07-26T00:37:09Z")
Can you provide more details about data view ':so-\*'? Is it an elasticsearch index? Is it rolled up index? Or data stream? Are you using cross cluster search? Tooltip properties are fetched with a request that looks like the below. Can you try running the command below in [Console](https://www.elastic.co/guide/en/kibana/master/console-kibana.html). Swapping `kibana_sample_data_logs` for your elasticsearch index name, `PoR9NoIBxuPCX5j4sJD_` with your document id, and `clientip` with your field name. What is the response? ```auto POST kibana_sample_data_logs/_search { "track_total_hits": false, "size": 1, "_source": false, "fields": [ "clientip" ], "query": { "bool": { "must": [], "filter": [ { "bool": { "filter": [ { "bool": { "should": [ { "match_phrase": { "_id": "PoR9NoIBxuPCX5j4sJD_" } } ], "minimum_should_match": 1 } }, { "bool": { "should": [ { "match_phrase": { "_index": "kibana_sample_data_logs" } } ], "minimum_should_match": 1 } } ] } } ], "should": [], "must_not": [] } } } ``` ---
**Author:** ![DigitalDick](https://avatars.discourse-cdn.com/v4/letter/d/a9a28c/32.png) [@DigitalDick](https://discuss.elastic.co/u/DigitalDick)\ **Post date:** [July 26, 2022, 8:13am UTC](https://discuss.elastic.co/t/security-onion-kibana-unable-to-load-tooltip-content-in-maps/310535/5 "2022-07-26T08:13:20Z")
Hi, im very new to all this, so thanks for your time in helping. So, is this code you are referring to? ```auto POST /*%3Aso-*/_mvt/source.geo.location/5/15/10 { "grid_precision": 0, "exact_bounds": true, "extent": 4096, "query": { "bool": { "filter": [ { "range": { "@timestamp": { "format": "strict_date_optional_time", "gte": "2022-07-25T23:00:00.000Z", "lte": "2022-07-26T22:59:59.999Z" } } } ], "must": [], "must_not": [], "should": [] } }, "fields": [], "runtime_mappings": {}, "track_total_hits": 10001, "with_labels": false } ``` The above code is from here: ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/2/e29280578050a25bcabbf3fe71eb72b92ccfd6d2.jpeg) As for is it a rolled up index, i have no idea, how would i find that out? The data is coming from my netflow module within filebeats If I have done this right, ive copied your code and amended it tot this: ```auto POST /*%3Aso-*/_mvt/source.geo.location/5/15/10 { "track_total_hits": false, "size": 1, "_source": false, "fields": [ "client.ip" ], "query": { "bool": { "must": [], "filter": [ { "bool": { "filter": [ { "bool": { "should": [ { "match_phrase": { "_id": "vatnOYIBzmT8Qkyo7A4i_" } } ], "minimum_should_match": 1 } }, { "bool": { "should": [ { "match_phrase": { "_index": "/*%3Aso-*/_mvt/source.geo.location/5/15/10" } } ], "minimum_should_match": 1 } } ] } } ], "should": [], "must_not": [] } } } and i get this error { "error": "Incorrect HTTP method for uri [/*%3Aso-*%2F_mvt%2Fsource.geo.location%2F5%2F15%2F10?pretty=true] and method [POST], allowed: [HEAD, DELETE, PUT, GET]", "status": 405 } ``` Blockquote ---
**Author:** ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)\ **Post date:** [July 26, 2022, 1:30pm UTC](https://discuss.elastic.co/t/security-onion-kibana-unable-to-load-tooltip-content-in-maps/310535/6 "2022-07-26T13:30:28Z")
> So, is this code you are referring to? No. That is a different request used to fetch the documents for a tile. You can tell by [\_mvt](https://www.elastic.co/guide/en/elasticsearch/reference/master/search-vector-tile-api.html) instead of [\_search](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-search.html) in the path. The inspector shows the requests for the data on screen, it does not show requests for fetching tooltip data. What are the names of your indices in Elasticsearch? You can get this information by running `GET /_cat/indices` in console. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 23, 2022, 1:31pm UTC](https://discuss.elastic.co/t/security-onion-kibana-unable-to-load-tooltip-content-in-maps/310535/7 "2022-08-23T13:31:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.