@mstaudinger are you trying to filter by index in Timelion? Timelion behaves differently than Visualize/Discover/Dashboards and you can actually use something similar to the following Timelion syntax to filter by index .es(index:logstash-default-web-*)