Searching your data
editSearching your data
editThe Maps application embeds the query bar for real-time ad hoc search. Only layers requesting data from Elasticsearch are filtered when you submit a search request.
You can create a layer that requests data from Elasticsearch from the following:
-
Vector layer with:
- Documents source
- Grid aggregation source
- Terms join
- Heat map layer with Grid aggregation source
Searching across multiple indices
editYour map might contain multiple Elasticsearch indices. This can occur when your map contains two or more layers with Elasticsearch sources from different indices. This can also occur with a single layer with an Elasticsearch source and a Terms join.
Searching across multiple indices might sometimes result in empty layers. The most common cause for empty layers are searches for a field that exists in one index, but does not exist in other indices. Add _index to your search to include documents from indices that do not contain a search field.
For example, suppose you have a vector layer showing the kibana_sample_data_logs
documents
and another vector layer with kibana_sample_data_flights
documents.
(See adding sample data
to install the kibana_sample_data_logs
and kibana_sample_data_flights
indices.)
If you query for
machine.os.keyword : "osx"
the kibana_sample_data_flights
layer is empty because the index
kibana_sample_data_flights
does not contain the field machine.os.keyword
and no documents match the query.
If you instead query for
machine.os.keyword : "osx" or _index : "kibana_sample_data_flights"
the kibana_sample_data_flights
layer includes data.