kibana/docs/maps/search.asciidoc

[role="xpack"]
[[maps-search]]
== Search geographic data

Search across the layers in your map to focus on just the data you want. Combine free text search with field-based search using the <<kuery-query,{kib} Query Language>>. Set the time filter to restrict layers by time.

This image shows an example of global search and global time narrowing results.

[role="screenshot"]
image::maps/images/global_search_bar.png[global search and global time narrowing results]

Only layers requesting data from {es} are narrowed by global search and global time.
To add a layer that requests data from {es} to your map, click *Add layer*, then select one of the following:

* Documents

* Choropleth

* Clusters and grid

* Heat map

* Point to point

* Top hits per entity

* Tracks

[float]
[[maps-narrow-layer-by-global-search]]
==== Narrow layers by global search

Layers that request data from {es} are narrowed when you submit a <<kibana-concepts-searching-your-data, search>>.
Layers narrowed by semi-structured search and filters contain the filter icon image:maps/images/filter_icon.png[] next to the layer name in the legend.

To prevent the global search from applying to a layer, configure the following:

* In *Filtering*, clear the *Apply global search to layer data* checkbox to turn off global search for the layer source.

* In *Term joins*, clear the *Apply global search to join* checkbox to turn off global search for the <<terms-join, term join>>.

[float]
[[maps-narrow-layer-by-global-time]]
==== Narrow layers by global time

Layers that request data from {es} using a <<data-views, data view>> with a configured time field are narrowed by the <<set-time-filter, global time>>.
These layers contain the clock icon image:maps/images/clock_icon.png[clock icon] next to the layer name in the legend.

Use the time slider to quickly select time slices within the global time range:

. Click image:maps/images/timeslider_toggle_icon.png[timeslider icon] to open the time slider.
. Click previous and next buttons to advance the time slice backward or forward. 
. Click play to animate your spatial temporal data.

To prevent the global time filter from applying to a layer, configure the following:

* In *Filtering*, clear the *Apply global time to layer data* checkbox to turn off the global time for the layer source.

* In *Term joins*, clear the *Apply global time to join* checkbox to turn off the global time for the <<terms-join, term join>>.

[float]
[[maps-refresh-layer]]
==== Refresh layer data

Layers that request data from {es} re-fetch data when <<set-time-filter, automatic refresh>> fires and when you click *Refresh*.

To prevent refreshing layer data, configure the following:

* In *Filtering*, clear the *Apply global refresh to layer data* checkbox to turn off refresh for the layer source.


[role="xpack"]
[[maps-create-filter-from-map]]
=== Create filters from a map

Create filters from your map to focus in on just the data you want. *Maps* provides three ways to create filters:

* <<maps-map-extent-filter>>
* <<maps-spatial-filters>>
* <<maps-phrase-filter>>

[float]
[[maps-map-extent-filter]]
==== Filter dashboard by map bounds

To filter your dashboard by your map bounds as you pan and zoom your map:

. Open the main menu, and then click *Dashboard*.
. Select your dashboard from the list or click *Create dashboard*.
. If your dashboard does not have a map, add a map panel.
. Click the gear icon image:maps/images/gear_icon.png[gear icon] to open the map panel menu.
. Select *More* to view all panel options.
. Select *Filter dashboard by map bounds*.
. Select the checkbox for your map panel.

[float]
[[maps-spatial-filters]]
==== Spatial filters

A spatial filter narrows search results to documents that either intersect with, are within, or do not intersect with the specified geometry.

Spatial filters have the following properties:

* *Geometry label* enables you to provide a meaningful name for your spatial filter.
* *Spatial relation* determines the {ref}/query-dsl-geo-shape-query.html#geo-shape-spatial-relations[spatial relation operator] to use at search time.
* *Action* specifies whether to apply the filter to the current view or to a drilldown action. 

NOTE: {kibana-ref}/drilldowns.html[Drilldowns] are available only if the map is a panel in a {kibana-ref}/dashboard.html[dashboard], and not within the Maps application.

You can create spatial filters in two ways:

* Click the tool icon image:maps/images/tools_icon.png[tool icon], and then draw a shape, bounding box, or distance on the map to define the spatial filter.
* Click *Filter by geometry* in a <<maps-vector-tooltip-locking, locked tooltip>>, and then use the feature's geometry for the spatial filter.

[role="screenshot"]
image::maps/images/create_spatial_filter.png[]

[float]
[[maps-phrase-filter]]
==== Phrase filters

A phrase filter narrows search results to documents that contain the specified text.
You can create a phrase filter by clicking the plus icon image:maps/images/gs_plus_icon.png[] in a <<maps-vector-tooltip-locking, locked tooltip>>.
If the map is a dashboard panel with drilldowns, you can apply a phrase filter to a drilldown by selecting the drilldown action.

[role="xpack"]
[[maps-layer-based-filtering]]
=== Filter a single layer

You can apply a search request to individual layers by setting `Filters` in the layer details panel.
Click the *Add filter* button to add a filter to a layer.

NOTE: Layer filters are not applied to the right side of *term joins*. You can apply a search request to the right side of *term joins* by setting the *where* clause in the join definition. For example, suppose you have a layer with a term join where the left side is roads and the right side is traffic volume measurements. A layer filter of `roadType is "highway"` is applied to the roads index, but not to the traffic volume measurements index.

[role="screenshot"]
image::maps/images/layer_search.png[]

[role="xpack"]
[[maps-search-across-multiple-indices]]
=== Search across multiple indices

Your map might contain multiple {es} indices.
This can occur when your map contains two or more layers with {es} sources from different indices.
This can also occur with a single layer with an {es} source and a <<terms-join>>.

Searching across multiple indices might sometimes result in empty layers.
The most common cause for empty layers are searches for a field that exists in one index, but does not exist in other indices.

[float]
[[maps-disable-search-for-layer]]
==== Disable global search for a layer

One strategy for eliminating unintentional empty layers from a cross index search is to <<maps-narrow-layer-by-global-search, disable global search for a layer>>.

[float]
[[maps-add-index-search]]
==== Use _index in a search

Add {ref}/mapping-index-field.html[_index] to your search to include documents from indices that do not contain a search field.

For example, suppose you have a vector layer showing the `kibana_sample_data_logs` documents
and another vector layer with `kibana_sample_data_flights` documents.
(See <<add-sample-data, adding sample data>>
to install the `kibana_sample_data_logs` and `kibana_sample_data_flights` indices.)

If you query for
--------------------------------------------------
machine.os.keyword : "osx"
--------------------------------------------------
the `kibana_sample_data_flights` layer is empty because the index
`kibana_sample_data_flights` does not contain the field `machine.os.keyword` and no documents match the query.

[role="screenshot"]
image::maps/images/global_search_multiple_indices_query1.png[]

If you instead query for
--------------------------------------------------
machine.os.keyword : "osx" or _index : "kibana_sample_data_flights"
--------------------------------------------------
the `kibana_sample_data_flights` layer includes data.

[role="screenshot"]
image::maps/images/global_search_multiple_indices_query2.png[]