diff --git a/docs/maps/images/top_hits.png b/docs/maps/images/top_hits.png index 45bbf575f10dd..a791e23b869ef 100644 Binary files a/docs/maps/images/top_hits.png and b/docs/maps/images/top_hits.png differ diff --git a/docs/maps/maps-aggregations.asciidoc b/docs/maps/maps-aggregations.asciidoc index 692e30a6665ed..2b65ae99a381b 100644 --- a/docs/maps/maps-aggregations.asciidoc +++ b/docs/maps/maps-aggregations.asciidoc @@ -20,6 +20,8 @@ You can add the following metric aggregations: * *Sum.* The total value. +* *Top term.* The most common value. + * *Unique count.* The number of distinct values. Use aggregated layers with document layers to show aggregated views when the map shows larger @@ -37,14 +39,24 @@ image::maps/images/grid_to_docs.gif[] The *Grid aggregation* source uses {ref}/search-aggregations-bucket-geotilegrid-aggregation.html[GeoTile grid aggregation] to group your documents into grids. You can calculate metrics for each gridded cell. -You can symbolize grid aggregation metrics as: +Symbolize grid aggregation metrics as: + +*Clusters*:: Creates a <> with a cluster symbol for each gridded cell. +The cluster location is the weighted centroid for all geo-points in the gridded cell. *Grid rectangles*:: Creates a <> with a bounding box polygon for each gridded cell. *Heat map*:: Creates a <> that clusters the weighted centroids for each gridded cell. -*Clusters*:: Creates a <> with a cluster symbol for each gridded cell. -The cluster location is the weighted centroid for all geo-points in the gridded cell. +To enable grid aggregation: + +. Click *Add layer*, then select the *Grid aggregation* source. + +To enable a blended layer that dynamically shows clusters or documents: + +. Click *Add layer*, then select the *Documents* source. +. Configure *Index pattern* and the *Geospatial field*. To enable clustering, the *Geospatial field* must be set to a field mapped as {ref}/geo-point.html[geo_point]. +. In *Scaling*, select *Show clusters when results exceed 10000*. [role="xpack"] @@ -55,10 +67,11 @@ You can display the most relevant documents per entity, for example, the most re To get this data, {es} first groups your data using a {ref}/search-aggregations-bucket-terms-aggregation.html[terms aggregation], then accumulates the most relevant documents based on sort order for each entry using a {ref}/search-aggregations-metrics-top-hits-aggregation.html[top hits metric aggregation]. -Top hits per entity is available for <> with *Documents* source. To enable top hits: -. In *Sorting*, select the *Show documents per entity* checkbox. +. Click *Add layer* button and select *Documents* source. +. Configure *Index pattern* and *Geospatial field*. +. In *Scaling*, select *Show top hits per entity*. . Set *Entity* to the field that identifies entities in your documents. This field will be used in the terms aggregation to group your documents into entity buckets. . Set *Documents per entity* to configure the maximum number of documents accumulated per entity. diff --git a/docs/maps/vector-style.asciidoc b/docs/maps/vector-style.asciidoc index 80e4c4ed5f844..7bc8a909d1ec6 100644 --- a/docs/maps/vector-style.asciidoc +++ b/docs/maps/vector-style.asciidoc @@ -53,7 +53,7 @@ The `bytes` property value for each feature will fit on a linear scale from the To ensure symbols are consistent as you pan, zoom, and filter the map, quantitative data driven styling uses {ref}/search-aggregations-metrics-extendedstats-aggregation.html[extended_stats aggregation] to retrieve statistical metadata. Extended_stats is not available for numeric property values from the <> count, sum, and unique count. -To configure extended_stats,click the gear icon image:maps/images/gear_icon.png[] to configure extended_stats. Set *Sigma* to a smaller value to minimize outliers by moving the range minimum and maximum closer to the average. Clear the *Calculate range from indices* checkbox to turn off the extended_stats aggregation request. The gear icon is not available for numeric property values from the <> count, sum, and unique count. +To configure extended_stats, click the gear icon image:maps/images/gear_icon.png[]. Set *Sigma* to a smaller value to minimize outliers by moving the range minimum and maximum closer to the average. Clear the *Calculate range from indices* checkbox to turn off the extended_stats aggregation request. The gear icon is not available for numeric property values from the <> count, sum, and unique count. NOTE: When extended_stats is not used, symbols might be inconsistent as users pan, zoom, and filter the map. Without extended_stats, the range is calculated with data from the local layer. The range is re-calculated when layer data changes. @@ -76,16 +76,21 @@ When the symbol range minimum and maximum are the same and there is no range: [[maps-vector-style-qualitative-data-driven]] ==== Qualitative data driven styling -Qualitative data driven styling symbolizes non-numeric properties, such as strings and IP addresses, by category. +Qualitative data driven styling symbolizes properties, such as strings and IP addresses, by category. Qualitative data driven styling is available for the following styling properties: +* *Icon* * *Fill color* * *Border color* * *Label color* * *Label border color* -Qualitative data driven styling uses a {ref}/search-aggregations-bucket-terms-aggregation.html[terms aggregation] to retrieve the top nine categories for the property. Feature values within the top categories are assigned a unique color. Feature values outside of the top categories are grouped into the *Other* category. A feature is assigned the *Other* category when the property value is undefined. +To ensure symbols are consistent as you pan, zoom, and filter the map, qualitative data driven styling uses a {ref}/search-aggregations-bucket-terms-aggregation.html[terms aggregation]. The term aggregation retrieves the top nine categories for the property. Feature values within the top categories are assigned a unique style. Feature values outside of the top categories are grouped into the *Other* category. A feature is assigned the *Other* category when the property value is undefined. + +To configure the terms aggregation, click the gear icon image:maps/images/gear_icon.png[]. Clear the *Get categories from indice* checkbox to turn off the terms aggregation request. + +NOTE: When the terms aggregation is not used, symbols might be inconsistent as users pan, zoom, and filter the map. Without terms aggregation, the top categories are calculated with data from the local layer. The top categories are re-calculated when layer data changes. This image shows an example of quantitative data driven styling using the <> data set. The `machine.os.keyword` property determines the color of each symbol based on category.