# Filter in Timelion

**URL:** <https://discuss.elastic.co/t/filter-in-timelion/225481>\
**Category:** Kibana\
**Tags:** timelion\
**Created:** [March 28, 2020, 10:09am UTC](https://discuss.elastic.co/t/filter-in-timelion/225481 "2020-03-28T10:09:12Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![sai\_16](https://avatars.discourse-cdn.com/v4/letter/s/47e85d/32.png) [@sai\_16](https://discuss.elastic.co/u/sai_16)\
**Post date:** [March 28, 2020, 10:09am UTC](https://discuss.elastic.co/t/filter-in-timelion/225481/1 "2020-03-28T10:09:12Z")

</div>

I created a timelion to display cpu usage, I need to pass server names dynamically, using filter. Created dashboard but not finding all the options in "add filter" , it just shows me index, message, message.keyword but I need beat.hostname , how do I get that?

Add filter shows all the options in other visualizations but not showing on timelion

---

<div class="post-metadata">

**Author:** ![mikecote](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mikecote/32/58549_2.png) [@mikecote](https://discuss.elastic.co/u/mikecote)\
**Post date:** [March 30, 2020, 1:52pm UTC](https://discuss.elastic.co/t/filter-in-timelion/225481/2 "2020-03-30T13:52:40Z")

</div>

Hi @sai_16,

The filter list will only show the fields for your default index pattern.

If you want to make the beats index the default index pattern, you can do so by going into Management -\> Index Patterns -\> Select the index pattern you wish to make your default -\> Click the star on the top right where it says "Set as default index".

![Screen Shot 2020-03-30 at 9.35.38 AM](https://us1.discourse-cdn.com/elastic/original/3X/d/5/d548299be50bfd180ca0627a11a120726f2087d9.png)

If changing the default index pattern doesn't work for you, you can still filter your field by using "Edit as Query DSL" in the top right of the filter window and set something like this:

```auto
{
  "query": {
    "bool": {
      "must": {
        "term": {
          "beat.hostname": "artifacts.elastic.co"
        }
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![sai\_16](https://avatars.discourse-cdn.com/v4/letter/s/47e85d/32.png) [@sai\_16](https://discuss.elastic.co/u/sai_16)\
**Post date:** [March 31, 2020, 9:57am UTC](https://discuss.elastic.co/t/filter-in-timelion/225481/3 "2020-03-31T09:57:21Z")

</div>

Thanks @mikecote

---

<div class="post-metadata">

**Author:** ![sai\_16](https://avatars.discourse-cdn.com/v4/letter/s/47e85d/32.png) [@sai\_16](https://discuss.elastic.co/u/sai_16)\
**Post date:** [March 31, 2020, 10:01am UTC](https://discuss.elastic.co/t/filter-in-timelion/225481/4 "2020-03-31T10:01:38Z")

</div>

And one more query,is there a way to sum 2 fileds in area chart.  
I want my y-axis to be sum of these 2 fileds system.cpu.system.pct and system.cpu.user.pct  
I tried passing json input as doc['field1'].value + doc['field2'].value but didnt work,

---

<div class="post-metadata">

**Author:** ![mikecote](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mikecote/32/58549_2.png) [@mikecote](https://discuss.elastic.co/u/mikecote)\
**Post date:** [March 31, 2020, 6:21pm UTC](https://discuss.elastic.co/t/filter-in-timelion/225481/5 "2020-03-31T18:21:51Z")

</div>

Hi @sai_16,

You should be able to do so by creating a scripted field in the index pattern as follows

 ![Screen Shot 2020-03-31 at 2.20.50 PM](https://us1.discourse-cdn.com/elastic/original/3X/4/7/476ecec443a242cc09a41653fe3692727a0e1a5e.png)

Once that is created, the field should show up in your field select for your area chart.

---

<div class="post-metadata">

**Author:** ![sai\_16](https://avatars.discourse-cdn.com/v4/letter/s/47e85d/32.png) [@sai\_16](https://discuss.elastic.co/u/sai_16)\
**Post date:** [April 2, 2020, 2:38pm UTC](https://discuss.elastic.co/t/filter-in-timelion/225481/6 "2020-04-02T14:38:57Z")

</div>

@mikecote Thank you ,it helps.  
and sorry for too many followup questions,i do have one more now.

i'm doing a split series with system.process.name. It works fine but i want to know if i need to group some of the process into one category,how is that possible?

eg: system.process name has 10 process displayed,3 need to be grouped as one name ,2 as some other name.  
like group java and sql as Application and different name for some other procesess,is that possible?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 30, 2020, 2:39pm UTC](https://discuss.elastic.co/t/filter-in-timelion/225481/7 "2020-04-30T14:39:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.