Geospatial visualizations

  • Article

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Geospatial data can be visualized using the render operator in Kusto Desktop Explorer. To download Kusto Desktop Explorer, see Kusto.Explorer installation and user interface.

You can also use the Azure Data Explorer web UI.

For more information about visualization options, see Data visualization with Azure Data Explorer.

For more information about geospatial clustering, see Geospatial clustering.

Visualize points on a map

You can visualize points either using [Longitude, Latitude] columns, or GeoJSON column. Using a series column is optional. The [Longitude, Latitude] pair defines each point, in that order.

Example: Visualize points on a map

The following example finds storm events and visualizes 100 on a map.

StormEvents
| take 100
| project BeginLon, BeginLat
| render scatterchart with (kind = map)

Screenshot of sample storm events on a map.

Example: Visualize multiple series of points on a map

The following example visualizes multiple series of points, where the [Longitude, Latitude] pair defines each point, and a third column defines the series. In this example, the series is EventType.

StormEvents
| take 100
| project BeginLon, BeginLat, EventType
| render scatterchart with (kind = map)

Screenshot of sample storm series events on a map.

Example: Visualize series of points on data with multiple columns

The following example visualizes a series of points on a map. If you have multiple columns in the result, you must specify the columns to be used for xcolumn (Longitude), ycolumn (Latitude), and series.

StormEvents
| take 100
| render scatterchart with (kind = map, xcolumn = BeginLon, ycolumns = BeginLat, series = EventType)

Screenshot of sample storm series events using arguments.

Example: Visualize points on a map defined by GeoJSON dynamic values

The following example visualizes points on the map using GeoJSON dynamic values to define the points.

StormEvents
| project BeginLon, BeginLat
| summarize by hash=geo_point_to_s2cell(BeginLon, BeginLat, 5)
| project geo_s2cell_to_central_point(hash)
| render scatterchart with (kind = map)

Screenshot of sample storm GeoJSON events.

Visualization of pies or bubbles on a map

You can visualize pies or bubbles either using [Longitude, Latitude] columns, or GeoJSON column. These visualizations can be created with color or numeric axes.

Example: Visualize pie charts by location

The following example shows storm events aggregated by S2 cell. The chart aggregates events in pie charts by location.

StormEvents
| project BeginLon, BeginLat, EventType
| where geo_point_in_circle(BeginLon, BeginLat, real(-81.3891), 28.5346, 1000 * 100)
| summarize count() by EventType, hash = geo_point_to_s2cell(BeginLon, BeginLat)
| project geo_s2cell_to_central_point(hash), EventType, count_
| render piechart with (kind = map) // pie map rendering available only in Kusto Explorer desktop

Screenshot of storm events on a pie map.

Example: Visualize bubbles using a color axis

The following example shows storm events aggregated by S2 cell. The chart aggregates events in bubble by location. Since the color-axis ("count") is the same for all events, the render operator generates bubbles.

StormEvents
| project BeginLon, BeginLat, EventType
| where geo_point_in_circle(BeginLon, BeginLat, real(-81.3891), 28.5346, 1000 * 100)
| summarize count() by EventType, hash = geo_point_to_s2cell(BeginLon, BeginLat)
| project geo_s2cell_to_central_point(hash), count_
| extend Events = "count"
| render piechart with (kind = map) // pie map rendering available only in Kusto Explorer desktop

Screenshot of storm events on a bubble map.

Related content