Kibana Timelion Question Split Label More than 1 field

[Gundam_Airline]

How can I split more than 1 field in the label for Timelion. I have seen multiple post that shows 1 variable as shown in the link below but nothing for 2 or more. Can someone please give me an example that could assist me?

How to split lines based on a term in Timelion using split() or other?

You can use Regex in your label. It will be something like: .label(regex='.* username.keyword:(.*) > .*', label='$1')

Thanks

[afharo (Alejandro Fernandez Haro)]

Hi @Gundam_Airline,

You can declare the split parameter multiple times.

In the following example I'm plotting the data in the index kibana_sample_data_logs, splitting first by the 5 top url.keyword and then, by response.keyword:3

.es(
    index=kibana_sample_data_logs,
    split=url.keyword:5,
    split=response.keyword:3
)

The .label regex you mentioned is for breaking down the text

q:* > url.keyword:https://artifacts.elastic.co/downloads/apm-server/apm-server-6.3.2-amd64.deb > response.keyword:404 > count

Into something else.
For instance, if we want to present it as
404 - https://artifacts.elastic.co/downloads/apm-server/apm-server-6.3.2-amd64.deb instead, we need to apply the regex to that text as:

.label(
    regex='.* url.keyword:(.*) > response.keyword:(.*) > .*',
    label='$2 - $1'
)