# Tile Map not working with geoip **URL:** \ **Category:** Kibana\ **Created:** [November 14, 2015, 4:58pm UTC](https://discuss.elastic.co/t/tile-map-not-working-with-geoip/34591 "2015-11-14T16:58:28Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![tpnoonan](https://avatars.discourse-cdn.com/v4/letter/t/76d3ee/32.png) [@tpnoonan](https://discuss.elastic.co/u/tpnoonan)\ **Post date:** [November 14, 2015, 4:58pm UTC](https://discuss.elastic.co/t/tile-map-not-working-with-geoip/34591/1 "2015-11-14T16:58:28Z")
i've been working this weekend to enhance our net flow data being fed into ElasticSearch. I successfully setup log stash to publish geo ip data into my index (YAY!!!), but when I go to visualize in Kibana using a tile map i get "no results found" (boo). here's a sample document: { "\_index": "logstash-netflow-2015.11.14", "\_type": "logs", "\_id": "AVEG6NwNCPSzBia0\_KOh", "\_score": null, "\_source": { "@timestamp": "2015-11-14T16:53:54.455Z", "netflow": { "version": 5, "flow\_seq\_num": 40141873, "engine\_type": 0, "engine\_id": 0, "sampling\_algorithm": 0, "sampling\_interval": 0, "flow\_records": 30, "ipv4\_src\_addr": "74.122.204.3", "ipv4\_dst\_addr": "192.168.100.71", "ipv4\_next\_hop": "0.0.0.0", "input\_snmp": 5, "output\_snmp": 5, "in\_pkts": 1, "in\_bytes": 76, "first\_switched": "2015-11-14T16:53:49.455Z", "last\_switched": "2015-11-14T16:53:34.455Z", "l4\_src\_port": 123, "l4\_dst\_port": 123, "tcp\_flags": 0, "protocol": 17, "src\_tos": 0, "src\_as": 0, "dst\_as": 0, "src\_mask": 0, "dst\_mask": 24 }, "@version": "1", "host": "192.168.100.3", "geo\_ip": { "ip": "74.122.204.3", "country\_code2": "US", "country\_code3": "USA", "country\_name": "United States", "continent\_code": "NA", "region\_name": "KS", "city\_name": "Lenexa", "postal\_code": "66219", "latitude": 38.95060000000001, "longitude": -94.7791, "dma\_code": 616, "area\_code": 913, "timezone": "America/Chicago", "real\_region\_name": "Kansas", "location": [ -94.7791, 38.95060000000001 ], "coordinates": [ -94.7791, 38.95060000000001 ] } }, "fields": { "netflow.first\_switched": [ 1447520029455 ], "netflow.last\_switched": [ 1447520014455 ], "@timestamp": [ 1447520034455 ] }, "highlight": { "geo\_ip.ip.raw": [ "@kibana-highlighted-field@74.122.204.3@/kibana-highlighted-field@" ], "netflow.ipv4\_src\_addr.raw": [ "@kibana-highlighted-field@74.122.204.3@/kibana-highlighted-field@" ], "geo\_ip.ip": [ "@kibana-highlighted-field@74.122.204.3@/kibana-highlighted-field@" ], "netflow.ipv4\_src\_addr": [ "@kibana-highlighted-field@74.122.204.3@/kibana-highlighted-field@" ] }, "sort": [ 1447520034455 ] } The mapping for the index looks like this: name type format analyzed indexed controls \_index string Edit geoip.location geo\_point Edit @version string Edit \_source \_source Edit geo\_ip.ip.raw string Edit netflow.first\_switched date Edit netflow.ipv4\_dst\_addr.raw string Edit geo\_ip.timezone string Edit geo\_ip.longitude number Edit geo\_ip.real\_region\_name string Edit geo\_ip.latitude number Edit netflow.dst\_as number Edit netflow.in\_bytes number Edit geo\_ip.real\_region\_name.raw string Edit host string Edit geo\_ip.region\_name string Edit netflow.sampling\_interval number Edit geo\_ip.location number Edit netflow.src\_mask number Edit netflow.engine\_id number Edit netflow.ipv4\_next\_hop.raw string Edit netflow.tcp\_flags number Edit geo\_ip.area\_code number Edit geo\_ip.timezone.raw string Edit netflow.flow\_records number Edit geo\_ip.postal\_code.raw string Edit geo\_ip.ip string Edit geo\_ip.city\_name string Edit netflow.l4\_src\_port number Edit netflow.engine\_type number Edit netflow.src\_tos number Edit netflow.version number Edit geo\_ip.coordinates number Edit netflow.sampling\_algorithm number Edit geo\_ip.country\_name string Edit geo\_ip.continent\_code string Edit geo\_ip.country\_code2 string Edit geo\_ip.country\_code3 string Edit netflow.dst\_mask number Edit netflow.l4\_dst\_port number Edit geo\_ip.country\_name.raw string Edit netflow.flow\_seq\_num number Edit netflow.protocol number Edit netflow.output\_snmp number Edit geo\_ip.region\_name.raw string Edit netflow.ipv4\_src\_addr.raw string Edit geo\_ip.dma\_code number Edit host.raw string Edit netflow.in\_pkts number Edit netflow.last\_switched date Edit geo\_ip.country\_code3.raw string Edit netflow.src\_as number Edit netflow.ipv4\_next\_hop string Edit @timestamp date Edit geo\_ip.continent\_code.raw string Edit netflow.ipv4\_dst\_addr string Edit geo\_ip.city\_name.raw string Edit geo\_ip.country\_code2.raw string Edit netflow.input\_snmp number Edit netflow.ipv4\_src\_addr string Edit geo\_ip.postal\_code string I've tried deleting all of my indices and starting fresh but to no avail. My ELK stack is all the latest v2.0 stuff. Any ideas? ---
**Author:** ![tpnoonan](https://avatars.discourse-cdn.com/v4/letter/t/76d3ee/32.png) [@tpnoonan](https://discuss.elastic.co/u/tpnoonan)\ **Post date:** [November 14, 2015, 5:00pm UTC](https://discuss.elastic.co/t/tile-map-not-working-with-geoip/34591/2 "2015-11-14T17:00:31Z")
Oh and one more thing. The visualization setup is using count for the value, geohash as the aggregation and geoip.location as the field. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 2:09pm UTC](https://discuss.elastic.co/t/tile-map-not-working-with-geoip/34591/3 "2017-07-06T14:09:05Z")