# Data inconsistency in timelion graphs

**URL:** <https://discuss.elastic.co/t/data-inconsistency-in-timelion-graphs/133350>\
**Category:** Kibana\
**Tags:** timelion\
**Created:** [May 25, 2018, 5:46pm UTC](https://discuss.elastic.co/t/data-inconsistency-in-timelion-graphs/133350 "2018-05-25T17:46:55Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Amandeep\_Singh1](https://avatars.discourse-cdn.com/v4/letter/a/6f9a4e/32.png) [@Amandeep\_Singh1](https://discuss.elastic.co/u/Amandeep_Singh1)\
**Post date:** [May 25, 2018, 5:46pm UTC](https://discuss.elastic.co/t/data-inconsistency-in-timelion-graphs/133350/1 "2018-05-25T17:46:55Z")

</div>

I'm trying to plot a trend based(sum of cost for each day) and apply a split over the data based upon class id.

 ![58%20PM](https://us1.discourse-cdn.com/elastic/original/3X/c/b/cbe4d7dbd8f6d04b862e190c3aca84746ea2c46c.png)  
.es(index="egm-predicted\*",split="class\_id:5",metric="sum:cogs\_pred",timefield="order\_date").legend(position="ne",columns=4).label("class: $1", "^.\* \> class\_id:(\S+) \> .\*"),

but when i do normal line plot the result vary

 ![44%20PM](https://us1.discourse-cdn.com/elastic/original/3X/e/1/e10bbbaa25ba9fac3206adb03e3f538b7129c40e.png)

The timelion one is not selecting the classes in correct order, Though on increasing the split number the top classes in timelion changes

 ![18%20PM](https://us1.discourse-cdn.com/elastic/original/3X/8/f/8fadb630716dab815f26d209f9b4474d884ccd3a.png)

The question i have is inability to find why the top classes are varing

---

<div class="post-metadata">

**Author:** ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)\
**Post date:** [May 25, 2018, 7:10pm UTC](https://discuss.elastic.co/t/data-inconsistency-in-timelion-graphs/133350/2 "2018-05-25T19:10:09Z")

</div>

For the timelion config `.es(index=logstash*,timefield=@timestamp,split=machine.os.keyword:2,metric=sum:bytes)`, the elasticsearch request contains the following `aggs` parameter

```auto
{
  "aggs": {
   "q": {
    "meta": {
     "type": "split"
    },
    "filters": {
     "filters": {
      "*": {
       "query_string": {
        "query": "*"
       }
      }
     }
    },
    "aggs": {
     "machine.os.keyword": {
      "meta": {
       "type": "split"
      },
      "terms": {
       "field": "machine.os.keyword",
       "size": 2
      },
      "aggs": {
       "time_buckets": {
        "meta": {
         "type": "time_buckets"
        },
        "date_histogram": {
         "field": "@timestamp",
         "interval": "1s",
         "time_zone": "America/Denver",
         "extended_bounds": {
          "min": 1527273824235,
          "max": 1527274724235
         },
         "min_doc_count": 0
        },
        "aggs": {
         "sum(bytes)": {
          "sum": {
           "field": "bytes"
          }
         }
        }
       }
      }
     }
    }
   }
  },
}

```

Getting the timelion request is hacky. I do it by adding the line `console.log(JSON.stringify(body, null, ' '));` [here](https://github.com/elastic/kibana/blob/master/src/core_plugins/timelion/server/series_functions/es/index.js#L81)

For a line visualization, the elasticsearch request contains the following `aggs` parameter

```auto
{
  "aggs": {
    "3": {
      "terms": {
        "field": "machine.os.keyword",
        "size": 2,
        "order": {
          "1": "desc"
        }
      },
      "aggs": {
        "1": {
          "sum": {
            "field": "bytes"
          }
        },
        "2": {
          "date_histogram": {
            "field": "@timestamp",
            "interval": "30s",
            "time_zone": "America/Denver",
            "min_doc_count": 1
          },
          "aggs": {
            "1": {
              "sum": {
                "field": "bytes"
              }
            }
          }
        }
      }
    }
  },
}

```

The difference between the two is that the line graph visualization provides the `order` param for the terms aggregation while the timelion aggregation does not. The `order` is ordering buckets by the metric value - in this case means they are ordered by top sum. When order is not provided - as is the case with timelion, then the buckets are [ordered by count](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#search-aggregations-bucket-terms-aggregation-order).

---

<div class="post-metadata">

**Author:** ![Amandeep\_Singh1](https://avatars.discourse-cdn.com/v4/letter/a/6f9a4e/32.png) [@Amandeep\_Singh1](https://discuss.elastic.co/u/Amandeep_Singh1)\
**Post date:** [May 25, 2018, 7:21pm UTC](https://discuss.elastic.co/t/data-inconsistency-in-timelion-graphs/133350/3 "2018-05-25T19:21:59Z")

</div>

can we add provide the order timelion one ?

---

<div class="post-metadata">

**Author:** ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)\
**Post date:** [May 25, 2018, 7:39pm UTC](https://discuss.elastic.co/t/data-inconsistency-in-timelion-graphs/133350/4 "2018-05-25T19:39:19Z")

</div>

no. I would recommend opening an enhancement request [here](https://github.com/elastic/kibana/issues/new?template=Feature_request.md)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 22, 2018, 7:39pm UTC](https://discuss.elastic.co/t/data-inconsistency-in-timelion-graphs/133350/5 "2018-06-22T19:39:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.