Your map might contain multiple Elasticsearch indices. This can occur when your map contains two or more layers with Elasticsearch sources from different indices. This can also occur with a single layer with an Elasticsearch source and a Term join.
Searching across multiple indices might sometimes result in empty layers. The most common cause for empty layers are searches for a field that exists in one index, but does not exist in other indices.
Disable search for layeredit
To prevent the global search bar from applying search context to a layer, clear the Apply global filter to layer checkbox in Layer settings. Disabling the search context applies to the layer source and all term joins configured for the layer.
Use _index in your searchedit
Add _index to your search to include documents from indices that do not contain a search field.
For example, suppose you have a vector layer showing the
and another vector layer with
(See adding sample data
to install the
If you query for
machine.os.keyword : "osx"
kibana_sample_data_flights layer is empty because the index
kibana_sample_data_flights does not contain the field
machine.os.keyword and no documents match the query.
If you instead query for
machine.os.keyword : "osx" or _index : "kibana_sample_data_flights"
kibana_sample_data_flights layer includes data.