[Kibana Timelion] how to create the timelion chart based on the values of a field dynamically

[cheriemilk]

Hi Team,

I need your help for timelion chart.

Suppose I have below events.

@timestamp, module, page, action
t1, moduleA, pageA, moduleA.pageA.actionA
t2, moduleA, pageB, moduleA.pageB.actionB
t3, moduleA, pageC, moduleA.pageC.actionC
t4, moduleA, pageA, moduleA.pageA.actionA
t5, moduleA, pageB, moduleA.pageB.actionB
t6, moduleA, pageA, moduleA.pageA.actionA
...
...

And I want to create a timelion chart based on the action field to check how the number of usage for different actions changes as time goes by.
But I didn't want to create the chart with below timelion expression as there're are many many actions in the real events and I am not able to list them one by one.

.es(index=indexA,q="module:moduleA AND at:actionA").label("actionA" ).lines(fill=1,width=2).legend(columns=2, position=nw),
.es(index=indexA,q="module:moduleA AND at:actionB").label("actionA" ).lines(fill=1,width=2).legend(columns=2, position=nw),
.es(index=indexA,q="module:moduleA AND at:actionC").label("actionA" ).lines(fill=1,width=2).legend(columns=2, position=nw),
.es(...)
.title("Comparions - Key Actions")

Is there any convenient timelion expression to achieve this? For example, use regex like below (But It doesn't work as I am not familiar with regex)

.es(index=indexA,q="module:moduleA AND at:").label("moduleA.page[A|B] [$1]", "^. > type:(\S+) > .*")

Please help and advice!

Thanks,
Cherie

[wylie (Wylie Conlon)]

I don't know of anything that does exactly what you're thinking with the regexes, but you might be able to do this using a .split function or using a Terms aggregation in TSVB.

[cheriemilk]

what is TSVB?

[wylie (Wylie Conlon)]

TSVB is a visualization type in Kibana, it started as a graphical way to build Timelion visualizations but is more actively being developed against