# Kibana timelion split nested objects not working?

**URL:** https://discuss.elastic.co/t/kibana-timelion-split-nested-objects-not-working/182028
**Category:** Kibana
**Tags:** timelion
**Created:** [May 21, 2019, 2:36pm UTC](https://discuss.elastic.co/t/kibana-timelion-split-nested-objects-not-working/182028 "2019-05-21T14:36:02Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![jdmc562](https://avatars.discourse-cdn.com/v4/letter/j/bc8723/32.png) [@jdmc562](https://discuss.elastic.co/u/jdmc562)
#### Post date: [May 21, 2019, 2:36pm UTC](https://discuss.elastic.co/t/kibana-timelion-split-nested-objects-not-working/182028/1 "2019-05-21T14:36:02Z")

</div>

Hi , i'm trying to use the split funtion in timelion but i need to split on a nested field (in this case contextMap.ACTION), I am trying to do like this  
.es(q= "xxxx", split=contextMap.ACTION:10)  
but it does not seem to work ?

extract from data looks like  
"threadId": 498,  
"contextMap": {  
"STORAGELOC": "7344",  
"user": "null",  
"DU": "3333341",  
"ACTION": "moveDu"  
},

---

<div class="post-metadata">

### Author: ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)
#### Post date: [May 22, 2019, 7:57pm UTC](https://discuss.elastic.co/t/kibana-timelion-split-nested-objects-not-working/182028/2 "2019-05-22T19:57:03Z")

</div>

It seems to work for me... What behavior are you seeing? Have you tried wrapping the field name in quotes?

---

<div class="post-metadata">

### Author: ![Martin\_Fredriksson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/martin_fredriksson/32/46892_2.png) [@Martin\_Fredriksson](https://discuss.elastic.co/u/Martin_Fredriksson)
#### Post date: [May 27, 2019, 9:09pm UTC](https://discuss.elastic.co/t/kibana-timelion-split-nested-objects-not-working/182028/3 "2019-05-27T21:09:52Z")

</div>

Same for me on v6.6.2 on Elastic Cloud. Here is my query:

.es(index=event\_log,timefield=timestamp,q='name:person\_buy\_report',split='extra.payment\_method:5').bars()

I also tried without quotes, and with double quotes.

---

<div class="post-metadata">

### Author: ![Martin\_Fredriksson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/martin_fredriksson/32/46892_2.png) [@Martin\_Fredriksson](https://discuss.elastic.co/u/Martin_Fredriksson)
#### Post date: [May 28, 2019, 8:02am UTC](https://discuss.elastic.co/t/kibana-timelion-split-nested-objects-not-working/182028/4 "2019-05-28T08:02:06Z")

</div>

![06](https://us1.discourse-cdn.com/elastic/original/3X/9/5/956ae61a590ef2319000bbe519b9292c38fc4030.png)

The weird thing is I cannot split the bars on a regular Kibana visualization either. The field is available in "Significant Terms" but a regular vertical bar chart will just display empty if I choose to split them. The field has only two values ("credit", "stripe") and it shows up in the Discover tab:

Vizualisation in Kibana:

![20](https://us1.discourse-cdn.com/elastic/original/3X/3/d/3dc20425a6c8f1fc80685bf04b428f3d59bd1716.png)

Same visualization with split chart on nested field:

 ![46](https://us1.discourse-cdn.com/elastic/original/3X/3/9/39d913c20f4dfaff0ca53648b93677846efdd801.png)

Also I thought you might like the mapping. It's a keyword, although nested.

![48](https://us1.discourse-cdn.com/elastic/original/3X/6/9/6907dfb2ab55f5b19aad39308da5553b3d119b66.png)

---

<div class="post-metadata">

### Author: ![tedzzz](https://avatars.discourse-cdn.com/v4/letter/t/a5b964/32.png) [@tedzzz](https://discuss.elastic.co/u/tedzzz)
#### Post date: [June 24, 2019, 7:34am UTC](https://discuss.elastic.co/t/kibana-timelion-split-nested-objects-not-working/182028/5 "2019-06-24T07:34:21Z")

</div>

I encountered a similar issue in 7.x.  
I found [timelion-5-0-split-is-not-working-for-me](https://discuss.elastic.co/t/timelion-5-0-split-is-not-working-for-me/64897/9)

Although I don't fully understand why, using ".keyword" made my Timelion chart work.  
i.e., instead of: .es(index=event\_log,timefield=timestamp,q='name:person\_buy\_report',split='extra.payment\_method:5').bars()  
try:  
.es(index=event\_log,timefield=timestamp,q='name:person\_buy\_report',split='extra.payment\_method.keyword:5').bars()

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 22, 2019, 7:34am UTC](https://discuss.elastic.co/t/kibana-timelion-split-nested-objects-not-working/182028/6 "2019-07-22T07:34:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.