kibana/docs/maps/search.asciidoc

[role="xpack"]
[[maps-search]]
== Search geographic data

Search across the layers in your map to focus on just the data you want. Combine free text search with field-based search using the <<kuery-query,{kib} Query Language>>. Set the time filter to restrict layers by time.

This image shows an example of global search and global time narrowing results.

[role="screenshot"]
image::maps/images/global_search_bar.png[global search and global time narrowing results]

Only layers requesting data from {es} are narrowed by global search and global time.
To add a layer that requests data from {es} to your map, click *Add layer*, then select one of the following:

* Documents

* Choropleth

* Clusters and grid

* Heat map

* Point to point

* Top hits per entity

* Tracks

[float]
[[maps-narrow-layer-by-global-search]]
==== Narrow layers by global search

Layers that request data from {es} are narrowed when you submit a <<kibana-concepts-searching-your-data, search>>.
Layers narrowed by semi-structured search and filters contain the filter icon image:maps/images/filter_icon.png[] next to the layer name in the legend.

To prevent the global search from applying to a layer, configure the following:

* In *Filtering*, clear the *Apply global search to layer data* checkbox to turn off global search for the layer source.

* In *Term joins*, clear the *Apply global search to join* checkbox to turn off global search for the <<terms-join, term join>>.

[float]
[[maps-narrow-layer-by-global-time]]
==== Narrow layers by global time

Layers that request data from {es} using a <<data-views, data view>> with a configured time field are narrowed by the <<set-time-filter, global time>>.
These layers contain the clock icon image:maps/images/clock_icon.png[clock icon] next to the layer name in the legend.

Use the time slider to quickly select time slices within the global time range:

. Click image:maps/images/timeslider_toggle_icon.png[timeslider icon] to open the time slider.
. Click previous and next buttons to advance the time slice backward or forward. 
. Click play to animate your spatial temporal data.

To prevent the global time filter from applying to a layer, configure the following:

* In *Filtering*, clear the *Apply global time to layer data* checkbox to turn off the global time for the layer source.

* In *Term joins*, clear the *Apply global time to join* checkbox to turn off the global time for the <<terms-join, term join>>.

[float]
[[maps-refresh-layer]]
==== Refresh layer data

Layers that request data from {es} re-fetch data when <<set-time-filter, automatic refresh>> fires and when you click *Refresh*.

To prevent refreshing layer data, configure the following:

* In *Filtering*, clear the *Apply global refresh to layer data* checkbox to turn off refresh for the layer source.


[role="xpack"]
[[maps-create-filter-from-map]]
=== Create filters from a map

Create filters from your map to focus in on just the data you want. *Maps* provides three ways to create filters:

* <<maps-map-extent-filter>>
* <<maps-spatial-filters>>
* <<maps-phrase-filter>>

[float]
[[maps-map-extent-filter]]
==== Filter dashboard by map extent

A map extent shows uniform data across all panels.
As you pan and zoom your map, all panels will update to only include data that is visible in your map.

To enable filtering your dashboard by map extent:

* Open the main menu, and then click *Dashboard*.
* Select your dashboard from the list or click *Create dashboard*.
* If your dashboard does not have a map, add a map panel.
* Click the gear icon image:maps/images/gear_icon.png[gear icon] to open the map panel menu.
* Select *More* to view all panel options.
* Select *Enable filter by map extent*.

[role="screenshot"]
image::maps/images/enable_filter_by_map_extent.png[]

[float]
[[maps-spatial-filters]]
==== Spatial filters

A spatial filter narrows search results to documents that either intersect with, are within, or do not intersect with the specified geometry.

You can create spatial filters in two ways:

* Click the tool icon image:maps/images/tools_icon.png[], and then draw a shape, bounding box, or distance on the map to define the spatial filter.
* Click *Filter by geometry* in a <<maps-vector-tooltip-locking, locked tooltip>>, and then use the feature's geometry for the spatial filter.

Spatial filters have the following properties:

* *Geometry label* enables you to provide a meaningful name for your spatial filter.
* *Spatial relation* determines the {ref}/query-dsl-geo-shape-query.html#_spatial_relations[spatial relation operator] to use at search time.
* *Action* specifies whether to apply the filter to the current view or to a drilldown action. Only available when the map is a panel in a {kibana-ref}/dashboard.html[dashboard] with {kibana-ref}/drilldowns.html[drilldowns].

[role="screenshot"]
image::maps/images/create_spatial_filter.png[]

[float]
[[maps-phrase-filter]]
==== Phrase filters

A phrase filter narrows search results to documents that contain the specified text.
You can create a phrase filter by clicking the plus icon image:maps/images/gs_plus_icon.png[] in a <<maps-vector-tooltip-locking, locked tooltip>>.
If the map is a dashboard panel with drilldowns, you can apply a phrase filter to a drilldown by selecting the drilldown action.

[role="xpack"]
[[maps-layer-based-filtering]]
=== Filter a single layer

You can apply a search request to individual layers by setting `Filters` in the layer details panel.
Click the *Add filter* button to add a filter to a layer.

NOTE: Layer filters are not applied to *term joins*. You can apply a search request to *term joins* by setting the *where* clause in the join definition.

[role="screenshot"]
image::maps/images/layer_search.png[]

[role="xpack"]
[[maps-search-across-multiple-indices]]
=== Search across multiple indices

Your map might contain multiple {es} indices.
This can occur when your map contains two or more layers with {es} sources from different indices.
This can also occur with a single layer with an {es} source and a <<terms-join>>.

Searching across multiple indices might sometimes result in empty layers.
The most common cause for empty layers are searches for a field that exists in one index, but does not exist in other indices.

[float]
[[maps-disable-search-for-layer]]
==== Disable global search for a layer

One strategy for eliminating unintentional empty layers from a cross index search is to <<maps-narrow-layer-by-global-search, disable global search for a layer>>.

[float]
[[maps-add-index-search]]
==== Use _index in a search

Add {ref}/mapping-index-field.html[_index] to your search to include documents from indices that do not contain a search field.

For example, suppose you have a vector layer showing the `kibana_sample_data_logs` documents
and another vector layer with `kibana_sample_data_flights` documents.
(See <<add-sample-data, adding sample data>>
to install the `kibana_sample_data_logs` and `kibana_sample_data_flights` indices.)

If you query for
--------------------------------------------------
machine.os.keyword : "osx"
--------------------------------------------------
the `kibana_sample_data_flights` layer is empty because the index
`kibana_sample_data_flights` does not contain the field `machine.os.keyword` and no documents match the query.

[role="screenshot"]
image::maps/images/global_search_multiple_indices_query1.png[]

If you instead query for
--------------------------------------------------
machine.os.keyword : "osx" or _index : "kibana_sample_data_flights"
--------------------------------------------------
the `kibana_sample_data_flights` layer includes data.

[role="screenshot"]
image::maps/images/global_search_multiple_indices_query2.png[]