How to enhance results on timelion


(Rahul Sahotay) #1

Hello There!

I'm using es query in Timelion to showcase vulnerability report. In my case, we have vulnerabilities in the following manner
Medium > High > Critical

But I want to enlarge Critical so that everyone will focus on that

Here is the details view of my query:

(.es(index=regscan*, q='log_type:vulnerability AND severity:medium', metric='cardinality:_id').label('Medium'), .es(index=regscan*, q='log_type:vulnerability AND severity:high', metric='cardinality:_id').label('High'), .es(index=regscan*, q='log_type:vulnerability AND severity:critical', metric='cardinality:_id').label('Critical')).bars(stack=true, width=100).color('GoldenRod:Red:DarkRed')

which shows graph


As you can see the number for Critical is very low compared to others and very hard to see in this graph.

Is there a way, if I hover to this, this will get maximize ?


(Tim Sullivan) #2

Hi, maybe just try putting the High severity counts on a secondary Y-Axis. Check out the .yaxis() function.


(Rahul Sahotay) #3

Hello @tsullivan

I have tried using .yaxis() but didn't get proper results , can you help me on this please.


(Tim Sullivan) #4

Hi, What do you mean by didn't get proper results? Can you share your expression?


(Rahul Sahotay) #5

It looks like this (that means i'm somewhere seeing stack at the bottom and also on the top)


(Tim Sullivan) #6

Interesting, thanks for the graphic.

Can you share your entire query as text though?


(Rahul Sahotay) #7

(.es(index=regscan*, q='log_type:vulnerability AND severity:critical', metric='cardinality:_id').yaxis(2, min=0,max=100, label="Critical vulnerability", color=Red).label('Critical'), .es(index=regscan*, q='log_type:vulnerability AND severity:high', metric='cardinality:_id').label('High') , .es(index=regscan*, q='log_type:vulnerability AND severity:medium', metric='cardinality:_id').label('Medium')).bars(stack=true, width=100)


(Rahul Sahotay) #8

Hello:

Did you get a chance to check on this please.

Thank you very much in advance!


(Rahul Sahotay) #9

Hello:

Anyone there to help me out please :smile:


(Rahul Sahotay) #10

@rashid

can you help me here!


(Tim Sullivan) #11

Hi, sorry for the delayed response - I haven't had a chance to look into this until now.

I think it looks strange because stacked bars make no sense when you have multiple y-axes. I would probably do this expression to turn off stacking

(
.es(q='severity:critical')
  .yaxis(2, label="Critical")
  .label('Critical')
  .color(Red),
.es(q='severity:high')
  .yaxis(1, label="Med / High")
  .label('High')
  .color(Orange),
.es(q='severity:medium')
  .yaxis(1)
  .label('Medium')
  .color(Yellow)
)
.bars(stack=false)

(system) #12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.