Your map might contain multiple Elasticsearch indices. This can occur when your map contains two or more layers with Elasticsearch sources from different indices. This can also occur with a single layer with an Elasticsearch source and a Term join.
Searching across multiple indices might sometimes result in empty layers. The most common cause for empty layers are searches for a field that exists in one index, but does not exist in other indices.
Disable search for a layeredit
You can prevent the search bar from applying search context to a layer by configuring the following:
- In Filtering, clear the Apply global filter to layer data checkbox to turn off the global search context for the layer source.
- In Term joins, clear the Apply global filter to join checkbox to turn off the global search context for the term join.
Use _index in a searchedit
Add _index to your search to include documents from indices that do not contain a search field.
For example, suppose you have a vector layer showing the
and another vector layer with
(See adding sample data
to install the
If you query for
machine.os.keyword : "osx"
kibana_sample_data_flights layer is empty because the index
kibana_sample_data_flights does not contain the field
machine.os.keyword and no documents match the query.
If you instead query for
machine.os.keyword : "osx" or _index : "kibana_sample_data_flights"
kibana_sample_data_flights layer includes data.