# How to enhance results on timelion

**URL:** <https://discuss.elastic.co/t/how-to-enhance-results-on-timelion/134076>\
**Category:** Kibana\
**Tags:** timelion\
**Created:** [May 31, 2018, 3:00pm UTC](https://discuss.elastic.co/t/how-to-enhance-results-on-timelion/134076 "2018-05-31T15:00:51Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![sahotay](https://avatars.discourse-cdn.com/v4/letter/s/898d66/32.png) [@sahotay](https://discuss.elastic.co/u/sahotay)\
**Post date:** [May 31, 2018, 3:00pm UTC](https://discuss.elastic.co/t/how-to-enhance-results-on-timelion/134076/1 "2018-05-31T15:00:52Z")

</div>

Hello There!

I'm using es query in Timelion to showcase vulnerability report. In my case, we have vulnerabilities in the following manner  
Medium \> High \> Critical

But I want to enlarge Critical so that everyone will focus on that

Here is the details view of my query:

> (.es(index=regscan\*, q='log\_type:vulnerability AND severity:medium', metric='cardinality:\_id').label('Medium'), .es(index=regscan\*, q='log\_type:vulnerability AND severity:high', metric='cardinality:\_id').label('High'), .es(index=regscan\*, q='log\_type:vulnerability AND severity:critical', metric='cardinality:\_id').label('Critical')).bars(stack=true, width=100).color('GoldenRod:Red:DarkRed')

which shows graph

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/f/0fdf44e809c401d029449ba23cb3a3faa7c2be93.png)  
As you can see the number for Critical is very low compared to others and very hard to see in this graph.

Is there a way, if I hover to this, this will get maximize ?

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [May 31, 2018, 7:38pm UTC](https://discuss.elastic.co/t/how-to-enhance-results-on-timelion/134076/2 "2018-05-31T19:38:11Z")

</div>

Hi, maybe just try putting the High severity counts on a secondary Y-Axis. Check out the `.yaxis()` function.

---

<div class="post-metadata">

**Author:** ![sahotay](https://avatars.discourse-cdn.com/v4/letter/s/898d66/32.png) [@sahotay](https://discuss.elastic.co/u/sahotay)\
**Post date:** [June 4, 2018, 1:57pm UTC](https://discuss.elastic.co/t/how-to-enhance-results-on-timelion/134076/3 "2018-06-04T13:57:03Z")

</div>

Hello @tsullivan

I have tried using `.yaxis()` but didn't get proper results , can you help me on this please.

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [June 4, 2018, 4:27pm UTC](https://discuss.elastic.co/t/how-to-enhance-results-on-timelion/134076/4 "2018-06-04T16:27:31Z")

</div>

Hi, What do you mean by didn't get proper results? Can you share your expression?

---

<div class="post-metadata">

**Author:** ![sahotay](https://avatars.discourse-cdn.com/v4/letter/s/898d66/32.png) [@sahotay](https://discuss.elastic.co/u/sahotay)\
**Post date:** [June 4, 2018, 6:21pm UTC](https://discuss.elastic.co/t/how-to-enhance-results-on-timelion/134076/5 "2018-06-04T18:21:40Z")

</div>

> [@sahotay](#):
>
> .color('GoldenRod:Red:DarkRed')

It looks like this (that means i'm somewhere seeing stack at the bottom and also on the top)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/7/27ce864b50d88e7d5d6f0d418419ac8f5d2791e4.png)

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [June 4, 2018, 7:07pm UTC](https://discuss.elastic.co/t/how-to-enhance-results-on-timelion/134076/6 "2018-06-04T19:07:26Z")

</div>

Interesting, thanks for the graphic.

Can you share your entire query as text though?

---

<div class="post-metadata">

**Author:** ![sahotay](https://avatars.discourse-cdn.com/v4/letter/s/898d66/32.png) [@sahotay](https://discuss.elastic.co/u/sahotay)\
**Post date:** [June 4, 2018, 7:10pm UTC](https://discuss.elastic.co/t/how-to-enhance-results-on-timelion/134076/7 "2018-06-04T19:10:16Z")

</div>

> [@tsullivan](#):
>
> uery as text tho

`(.es(index=regscan*, q='log_type:vulnerability AND severity:critical', metric='cardinality:_id').yaxis(2, min=0,max=100, label="Critical vulnerability", color=Red).label('Critical'), .es(index=regscan*, q='log_type:vulnerability AND severity:high', metric='cardinality:_id').label('High') , .es(index=regscan*, q='log_type:vulnerability AND severity:medium', metric='cardinality:_id').label('Medium')).bars(stack=true, width=100)`

---

<div class="post-metadata">

**Author:** ![sahotay](https://avatars.discourse-cdn.com/v4/letter/s/898d66/32.png) [@sahotay](https://discuss.elastic.co/u/sahotay)\
**Post date:** [June 6, 2018, 8:55pm UTC](https://discuss.elastic.co/t/how-to-enhance-results-on-timelion/134076/8 "2018-06-06T20:55:40Z")

</div>

Hello:

Did you get a chance to check on this please.

Thank you very much in advance!

---

<div class="post-metadata">

**Author:** ![sahotay](https://avatars.discourse-cdn.com/v4/letter/s/898d66/32.png) [@sahotay](https://discuss.elastic.co/u/sahotay)\
**Post date:** [June 8, 2018, 4:02pm UTC](https://discuss.elastic.co/t/how-to-enhance-results-on-timelion/134076/9 "2018-06-08T16:02:25Z")

</div>

Hello:

Anyone there to help me out please 😄

---

<div class="post-metadata">

**Author:** ![sahotay](https://avatars.discourse-cdn.com/v4/letter/s/898d66/32.png) [@sahotay](https://discuss.elastic.co/u/sahotay)\
**Post date:** [June 11, 2018, 2:23pm UTC](https://discuss.elastic.co/t/how-to-enhance-results-on-timelion/134076/10 "2018-06-11T14:23:42Z")

</div>

@rashid

can you help me here!

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [June 11, 2018, 8:01pm UTC](https://discuss.elastic.co/t/how-to-enhance-results-on-timelion/134076/11 "2018-06-11T20:01:54Z")

</div>

Hi, sorry for the delayed response - I haven't had a chance to look into this until now.

I think it looks strange because stacked bars make no sense when you have multiple y-axes. I would probably do this expression to turn off stacking

```auto
(
.es(q='severity:critical')
  .yaxis(2, label="Critical")
  .label('Critical')
  .color(Red),
.es(q='severity:high')
  .yaxis(1, label="Med / High")
  .label('High')
  .color(Orange),
.es(q='severity:medium')
  .yaxis(1)
  .label('Medium')
  .color(Yellow)
)
.bars(stack=false)

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 9, 2018, 8:01pm UTC](https://discuss.elastic.co/t/how-to-enhance-results-on-timelion/134076/12 "2018-07-09T20:01:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
