Showing document fields as tooltips

Elastic Stack Kibana
#1

I'm missing something obvious here, I know I am, but I have struggled to find an answer.

I have a small index of 20 documents in ES 7.10.2 with a GeoPoint in the top level, with other fields stored as objects and nested.

I have created an index pattern, and created a layer all is good so far. I can filter by any field I require, but when I attempt to add a tooltip I am only shown the top level fields and the location

image

I'm trying to simulate section 3 from here - Create a map with multiple layers and data sources | Kibana Guide [7.10] | Elastic but where the guide simple says

    1. Add a tooltip field and select agent , bytes , clientip , host , machine.os , request , response , and timestamp .

It does not explain how to make those fields show, or why they wouldn't show. Am I missing something in the mapping that makes these fields appear?

#2

Just click on a fields right there like id and then hover over on the map and it will show up.. is that not working?

EDIT : Apologies... read too fast Nested Object hmmmm will need to look that up, it may not be supported yet.

Update : I am seeing my sub object fields fine in the tool tips selector and they are showing up fine in the tool tip. Check your index / Mappings or perhaps as simple as scrolling down?

If you have them as an nested array of objects or something like that it may not show but it should show simple sub objects.

Screen Shot 2021-01-31 at 11.19.43 AM
Screen Shot 2021-01-31 at 11.19.43 AM1582×1024 129 KB

Example my mapping for this looks something like this where details is an object

   },
    "details" : {
      "properties" : {
        "Eqpmnt_desc" : {
          "type" : "keyword"
        },
        "GS_District" : {
          "type" : "keyword"
        },
        "GS_HostName" : {
          "type" : "keyword"
        },
        "GS_IP_AddressPrimary_V4" : {
          "type" : "ip"
        },
        "GS_LocationGeo" : {
          "type" : "geo_point"
        },
      }
    }
#3

Thanks for you reply, it led me to re-look at it. I had two problems.

  1. Nested objects are not shown in tooltips. (I think your mapping would show "type" : "nested" if details was a nested object). So details in your mapping is just an object. (I think)
  2. I was switching back and forth with nested and objects and deleting the Index, and saw no change. However I was not deleting the Index_Pattern! Once I deleted that, recreated the mapping with objects instead of nested, and then recreated the index pattern, all the expected fields began to appear

Thanks for giving me the impetus to sort it. I was well and truely stumped earlier.

However I would says nested objects do not appear as tooltips. Thats my conclusion anyways.....

1 Like
#4

Cool good to know! ... Yes I should have been clearer between object and nested I cleaned that up

Ohh and we all forget to update index patterns from time to time

1 Like