Canvas - risk factor time series

[Raj_Kumar (Raj)]

HI there,

Am trying to create a new timeseries canvas visualization with timelion

filters
| timelion
query=".es(index=nessus-*, timefield='@timestamp', metric='count:risk_factor.keyword', split='risk_factor.keyword:10' ,q='!risk_factor:None')" interval="auto" from="now-7d"
| pointseries x="@timestamp" y="value" color="label"
| plot defaultStyle={seriesStyle points="0" lines="5" bars="0" color="#f8dd91"}
palette={palette "#882E72" "#B178A6" "#D6C1DE" "#1965B0" "#5289C7" "#7BAFDE" "#4EB265" "#90C987" "#CAE0AB" "#F7EE55" "#F6C141" "#F1932D" "#E8601C" "#DC050C" gradient=false}
font={font family="'Open Sans', Helvetica, Arial, sans-serif" size=14 align="left" color="#000000" weight="normal" underline=false italic=false}
| render css=".flot-tick-label {
color: #fff;
}
"

Is there a way to put a label for these risk factors so it shows only critical, high, medium and low

and could I assign specific colour to it , like critical : red , high: orange , medium : yellow and low:blue

Please do help me figure it out

Thanks,
Raj

[flash1293 (Joe Reuter)]

Hi, you can do this, by specifying individual es() functions with a chained label call for each risk factor:

Try this timelion query:

.es(index=nessus-*, timefield='@timestamp', metric='count:risk_factor.keyword' ,q='risk_factor:Low').label('Low risk'),
.es(index=nessus-*, timefield='@timestamp', metric='count:risk_factor.keyword' ,q='risk_factor:Medium').label('Medium risk'),
.es(index=nessus-*, timefield='@timestamp', metric='count:risk_factor.keyword' ,q='risk_factor:High').label('High risk'),
.es(index=nessus-*, timefield='@timestamp', metric='count:risk_factor.keyword' ,q='risk_factor:Critical').label('Critical risk'),

You can specify the color by clicking the little plus icon next to "Chart style" in the display tab and adding a "Series style". There you can specify color, width and so on ( or on the expression adding seriesStyle parameters for each of your series

seriesStyle={seriesStyle label="Critical risk" color="red" lines="2" points="2"}

)

[Raj_Kumar (Raj)]

Thank you Joe