-
Notifications
You must be signed in to change notification settings - Fork 42
Description
Hi, I have an elastic 8.3 and loaded some data in an index with a geopoint (from Geoip):
Here the part of index definition:
`"sourceip": {
"properties": {
"city_name": {
"type": "keyword",
"ignore_above": 1024
},
"continent_code": {
"type": "keyword",
"ignore_above": 1024
},
"continent_name": {
"type": "keyword",
"ignore_above": 1024
},
"country_iso_code": {
"type": "keyword",
"ignore_above": 1024
},
"country_name": {
"type": "keyword",
"ignore_above": 1024
},
"ip": {
"type": "ip"
},
"location": {
"type": "geo_point"
},
"name": {
"type": "keyword",
"ignore_above": 1024
},
"postal_code": {
"type": "keyword",
"ignore_above": 1024
},
"region_iso_code": {
"type": "keyword",
"ignore_above": 1024
},
"region_name": {
"type": "keyword",
"ignore_above": 1024
},
"timezone": {
"type": "keyword",
"ignore_above": 1024
}
}
},
`
This is the query to find the data:
GET cloak*/_search { "size": 500, "track_total_hits": false, "fields": [ { "field": "@timestamp", "format": "date_time" } ], "script_fields": {}, "stored_fields": [ "*" ], "runtime_mappings": {}, "_source": { "excludes": [] }, "query": { "bool": { "must": [], "filter": [ { "bool": { "should": [ { "match_phrase": { "Cloak.UUID.keyword": "9e547c6e-d2d8-4888-b8ae-fc181c903970" } } ], "minimum_should_match": 1 } }, { "bool": { "must": [ { "exists": { "field": "sourceip.location" } }, { "geo_bounding_box": { "sourceip.location": { "top_left": [ -180, 79.17133 ], "bottom_right": [ 180, -66.51326 ] } } } ] } }, { "range": { "@timestamp": { "format": "strict_date_optional_time", "gte": "2021-07-13T07:00:00.000Z", "lte": "2022-07-14T06:32:12.333Z" } } } ], "should": [], "must_not": [] } } }
This query does not return data, if I remove the geo_bounding_box, I get 2 records. Here is the location part of one of them:
"sourceip": { "geo": { "city_name": "San Mateo", "postal_code": "94404", "region_name": "California", "continent_code": "NA", "country_name": "United States", "location": { "lat": 37.5549, "lon": -122.2708 }, "region_iso_code": "US-CA", "country_iso_code": "US", "timezone": "America/Los_Angeles" },
Any suggestion?
Thanks`