How to enhance results on timelion

(Rahul Sahotay) #1

Hello There!

I'm using es query in Timelion to showcase vulnerability report. In my case, we have vulnerabilities in the following manner
Medium > High > Critical

But I want to enlarge Critical so that everyone will focus on that

Here is the details view of my query:

(.es(index=regscan*, q='log_type:vulnerability AND severity:medium', metric='cardinality:_id').label('Medium'), .es(index=regscan*, q='log_type:vulnerability AND severity:high', metric='cardinality:_id').label('High'), .es(index=regscan*, q='log_type:vulnerability AND severity:critical', metric='cardinality:_id').label('Critical')).bars(stack=true, width=100).color('GoldenRod:Red:DarkRed')

which shows graph

As you can see the number for Critical is very low compared to others and very hard to see in this graph.

Is there a way, if I hover to this, this will get maximize ?

(Tim Sullivan) #2

Hi, maybe just try putting the High severity counts on a secondary Y-Axis. Check out the .yaxis() function.

(Rahul Sahotay) #3

Hello @tsullivan

I have tried using .yaxis() but didn't get proper results , can you help me on this please.

(Tim Sullivan) #4

Hi, What do you mean by didn't get proper results? Can you share your expression?

(Rahul Sahotay) #5

It looks like this (that means i'm somewhere seeing stack at the bottom and also on the top)

(Tim Sullivan) #6

Interesting, thanks for the graphic.

Can you share your entire query as text though?

(Rahul Sahotay) #7

(.es(index=regscan*, q='log_type:vulnerability AND severity:critical', metric='cardinality:_id').yaxis(2, min=0,max=100, label="Critical vulnerability", color=Red).label('Critical'), .es(index=regscan*, q='log_type:vulnerability AND severity:high', metric='cardinality:_id').label('High') , .es(index=regscan*, q='log_type:vulnerability AND severity:medium', metric='cardinality:_id').label('Medium')).bars(stack=true, width=100)

(Rahul Sahotay) #8


Did you get a chance to check on this please.

Thank you very much in advance!

(Rahul Sahotay) #9


Anyone there to help me out please :smile:

(Rahul Sahotay) #10


can you help me here!

(Tim Sullivan) #11

Hi, sorry for the delayed response - I haven't had a chance to look into this until now.

I think it looks strange because stacked bars make no sense when you have multiple y-axes. I would probably do this expression to turn off stacking

  .yaxis(2, label="Critical")
  .yaxis(1, label="Med / High")

(system) #12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.