I'm trying to visualize usage of different parts of a web application, as determined by URL paths. I can run
split on the api.access.url field, but I'd like to exclude some of these results. For example, the top 5 hits returned by
I'm really only interested in "check" and "check_bundle" results at the moment (ideally in separate visualizations). Must I know ahead of time what the range of URL paths I wish to graph are and call them each individually (e.g.
.es(q='apache2-api.access.url:/check/778'))? Is Timelion not the right tool for the job?