# How to add a condition to filter out count greater than some value in Timelion?
**URL:** https://discuss.elastic.co/t/how-to-add-a-condition-to-filter-out-count-greater-than-some-value-in-timelion/86213
**Category:** Kibana
**Tags:** timelion
**Created:** [May 18, 2017, 8:39am UTC](https://discuss.elastic.co/t/how-to-add-a-condition-to-filter-out-count-greater-than-some-value-in-timelion/86213 "2017-05-18T08:39:45Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@elasticheart](https://discuss.elastic.co/u/elasticheart)
#### Post date: [May 18, 2017, 8:39am UTC](https://discuss.elastic.co/t/how-to-add-a-condition-to-filter-out-count-greater-than-some-value-in-timelion/86213/1 "2017-05-18T08:39:45Z")
Hi,
I am using ELK GA 5.0.0 and I have the below timelion code;
```
.es(index=mylogs-*, q='response:error',metric=count,split=username:10).divide(.es(index=mylogs-*, q='response:success',metric=count).if("eq", 0, .es(index=mylogs-*, q='response:error',metric=count).multiply(-1))).label("Ratio").lines(show=true,width=2).points(show=true,radius=4,fill=9,weight=0)
```
My log contain `time`, `user`, and `response`. Response can be either `error` or `success`. The code above will display `error` to `success` ratio for 10 users. It also handles division by zero. What I want is, I want to include the user only if the count of `error` for that user is greater than 100. It will be helpful if someone help me to achieve this.
Thanks in advance..
---
### Author:  [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)
#### Post date: [May 18, 2017, 9:05am UTC](https://discuss.elastic.co/t/how-to-add-a-condition-to-filter-out-count-greater-than-some-value-in-timelion/86213/2 "2017-05-18T09:05:42Z")
You can modify your query I think. If response is a number and represents time in ms, you can do:
```auto
q='response:error AND response:>=10000'
```
And the same for success. Not sure about the actual result, but that might be what you want
---
### Author:  [@elasticheart](https://discuss.elastic.co/u/elasticheart)
#### Post date: [May 18, 2017, 9:51am UTC](https://discuss.elastic.co/t/how-to-add-a-condition-to-filter-out-count-greater-than-some-value-in-timelion/86213/3 "2017-05-18T09:51:29Z")
Hi @Nico-DF , will this compare to the **count of** error responses **per user**?
---
### Author:  [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)
#### Post date: [May 18, 2017, 9:57am UTC](https://discuss.elastic.co/t/how-to-add-a-condition-to-filter-out-count-greater-than-some-value-in-timelion/86213/4 "2017-05-18T09:57:44Z")
Forget my previous message, it is absolutly not related to your problem ineed. Was just tired.
Anyway for your problem, it might be a bit clunky, but, in the same way you use a if in your division, can't you use one on error count? If inferior to 100 then 0 (or null maybe) else, the actual result?
---
### Author:  [@elasticheart](https://discuss.elastic.co/u/elasticheart)
#### Post date: [May 19, 2017, 4:34am UTC](https://discuss.elastic.co/t/how-to-add-a-condition-to-filter-out-count-greater-than-some-value-in-timelion/86213/5 "2017-05-19T04:34:30Z")
Hi @Nico-DF thanks for your help.
Could you kindly show me how to do that if else check in my code? I am a beginner and learning these kinds of stuffs, and dont have much idea how to accomplish this 🤔
---
### Author:  [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)
#### Post date: [May 19, 2017, 7:10am UTC](https://discuss.elastic.co/t/how-to-add-a-condition-to-filter-out-count-greater-than-some-value-in-timelion/86213/6 "2017-05-19T07:10:26Z")
Well the same way you've already used it in your code:
> [@elasticcloud](#):
>
> .es(index=mylogs-_, q='response:success',metric=count).if("eq", 0, .es(index=mylogs-_, q='response:error',metric=count).multiply(-1)
That means, if the result of your request is equals to 0, then the value will be .es(...)
Then, for your case, you want something like:
```auto
.es(index=mylogs-*, q='response:error',metric=count,split=username:10).if("lt", 100, null)
```
But I think it will take the 10 first user, and then if the condition is not satisfied, it will be null (or try 0). That means that like this, I'm not sure you will still have 10 users to display. You can try it.
For further info about conditionals in timelion:
> **[I have but one .condition(). Timeseries if-then-else with Timelion](https://www.elastic.co/blog/timeseries-if-then-else-with-timelion)**
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 16, 2017, 7:10am UTC](https://discuss.elastic.co/t/how-to-add-a-condition-to-filter-out-count-greater-than-some-value-in-timelion/86213/7 "2017-06-16T07:10:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.