How to enhance results on timelion

[sahotay (Rahul Sahotay)]

Hello There!

I'm using es query in Timelion to showcase vulnerability report. In my case, we have vulnerabilities in the following manner
Medium > High > Critical

But I want to enlarge Critical so that everyone will focus on that

Here is the details view of my query:

(.es(index=regscan*, q='log_type:vulnerability AND severity:medium', metric='cardinality:_id').label('Medium'), .es(index=regscan*, q='log_type:vulnerability AND severity:high', metric='cardinality:_id').label('High'), .es(index=regscan*, q='log_type:vulnerability AND severity:critical', metric='cardinality:_id').label('Critical')).bars(stack=true, width=100).color('GoldenRod:Red:DarkRed')

which shows graph

As you can see the number for Critical is very low compared to others and very hard to see in this graph.

Is there a way, if I hover to this, this will get maximize ?

[tsullivan (Tim Sullivan)]

Hi, maybe just try putting the High severity counts on a secondary Y-Axis. Check out the .yaxis() function.

[sahotay (Rahul Sahotay)]

Hello @tsullivan

I have tried using .yaxis() but didn't get proper results , can you help me on this please.

[tsullivan (Tim Sullivan)]

Hi, What do you mean by didn't get proper results? Can you share your expression?

[sahotay (Rahul Sahotay)]

@sahotay

.color('GoldenRod:Red:DarkRed')

It looks like this (that means i'm somewhere seeing stack at the bottom and also on the top)

[tsullivan (Tim Sullivan)]

Interesting, thanks for the graphic.

Can you share your entire query as text though?

[sahotay (Rahul Sahotay)]

@tsullivan

uery as text tho

(.es(index=regscan*, q='log_type:vulnerability AND severity:critical', metric='cardinality:_id').yaxis(2, min=0,max=100, label="Critical vulnerability", color=Red).label('Critical'), .es(index=regscan*, q='log_type:vulnerability AND severity:high', metric='cardinality:_id').label('High') , .es(index=regscan*, q='log_type:vulnerability AND severity:medium', metric='cardinality:_id').label('Medium')).bars(stack=true, width=100)

[sahotay (Rahul Sahotay)]

Hello:

Did you get a chance to check on this please.

Thank you very much in advance!

[sahotay (Rahul Sahotay)]

Hello:

Anyone there to help me out please

[sahotay (Rahul Sahotay)]

@rashid

can you help me here!

[tsullivan (Tim Sullivan)]

Hi, sorry for the delayed response - I haven't had a chance to look into this until now.

I think it looks strange because stacked bars make no sense when you have multiple y-axes. I would probably do this expression to turn off stacking

(
.es(q='severity:critical')
  .yaxis(2, label="Critical")
  .label('Critical')
  .color(Red),
.es(q='severity:high')
  .yaxis(1, label="Med / High")
  .label('High')
  .color(Orange),
.es(q='severity:medium')
  .yaxis(1)
  .label('Medium')
  .color(Yellow)
)
.bars(stack=false)