Import geospatial data
editImport geospatial data
editTo import geospatical data into the Elastic Stack, the data must be indexed as geo_point or geo_shape. Geospatial data comes in many formats. Choose an import tool based on the format of your geospatial data.
When you upload GeoJSON or delimited files in Kibana, there is a file size limit, which is configurable in Advanced Settings.
Security privileges
editThe Elastic Stack security features provide roles and privileges that control which users can upload files. You can manage your roles, privileges, and spaces in Stack Management in Kibana. For more information, see Security privileges, Kibana privileges, and Kibana role management.
To upload GeoJSON files and draw features in Kibana with Maps, you must have:
-
The
all
Kibana privilege for Maps -
The
all
Kibana privilege for Index Pattern Management -
The
create
andcreate_index
index privileges for destination indices -
To use the index in Maps, you must also have the
read
andview_index_metadata
index privileges for destination indices
To upload delimited files (such as CSV, TSV, or JSON files) on the Kibana home page, you must also have:
-
The
all
Kibana privilege for Discover -
The
manage_pipeline
ormanage_ingest_pipelines
cluster privilege -
The
manage
index privilege for destination indices
Upload delimited files with latitude and longitude columns
editOn the Kibana home page, you can upload a file and import it into an Elasticsearch index with latitude and longitude columns combined into a geo_point
field.
- Go to the Kibana home page and click Upload a file.
- Select a file in one of the supported file formats.
- Click Import.
- Select the Advanced tab.
- Set Index name.
-
If a combined
geo_point
field is not created automatically, click Add combined field, then click Add geo point field. - Fill out the form and click Add.
- Click Import.
Upload a GeoJSON file
editUpload GeoJSON indexes GeoJSON features as a geo_point
or geo_shape
.
- Create a new map.
- Click Add layer.
- Select Upload GeoJSON.
- Use the file chooser to select a GeoJSON file.
- Click Import file.
Draw features in a map
editUpload features into Elasticsearch by drawing lines, polygons, circles, bounding boxes, and points in a map.
To create a new index for drawing:
- Create a map.
- Click Add layer.
- Select Create index.
- Set Index name.
- Click Create index.
To open an existing index for drawing:
- Create a map.
- Click Add layer.
- Select Documents.
- Select the index pattern that points to your index. A index pattern can point to one or more indices. For feature editing, the data view must point to a single index.
- Click Add layer.
- Set Scaling to Limit results to 10,000.
-
In Filtering:
- Clear the Apply global search to layer data checkbox.
- If your data view contains a default time field, clear the Apply global time to layer data checkbox.
- Click Save & close.
- In the legend, click the layer name and select Edit features.
When feature editing is open, a feature editing toolbox is displayed on the left side of the map.
To draw features:
- Click on the line, polygon, circle, bounding box, or point icon.
-
Move the mouse cursor over the map and follow the on screen instructions to draw a feature.
When a feature is complete, the feature is added to the index as a new document.
- Repeat to draw additional features.
- When you are finished adding features, go to the legend, and click Exit under the layer name.
Upload data with IP addresses
editThe GeoIP processor adds information about the geographical location of IP addresses. See GeoIP processor for details. For private IP addresses, see Enriching data with GeoIPs from internal, private IP addresses.
Upload data with GDAL
editGDAL (Geospatial Data Abstraction Library) contains command line tools that can convert geospatial data between 75 different geospatial file formats and index that geospatial data into Elasticsearch. See Ingest geospatial data into Elasticsearch with GDAL for details.