# Kibana Timelion **URL:** \ **Category:** Kibana\ **Tags:** timelion\ **Created:** [August 2, 2017, 8:20pm UTC](https://discuss.elastic.co/t/kibana-timelion/95610 "2017-08-02T20:20:19Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![ashvita](https://avatars.discourse-cdn.com/v4/letter/a/ee59a6/32.png) [@ashvita](https://discuss.elastic.co/u/ashvita)\ **Post date:** [August 2, 2017, 8:20pm UTC](https://discuss.elastic.co/t/kibana-timelion/95610/1 "2017-08-02T20:20:19Z")
Hi, I want to visualize the count of certain keyword in my logs. 10.100.213.171 Aug 1 21:01:50 x86-hw user.notice Dpd: 5066:dm::NodeEvent I {[01:55:47] Ixd202Cc.cpp:514}ZTR: Ixd-2 :ConfigIgcc:ConfigIgcc for pif: 1 10.100.216.159 Aug 2 02:36:44 x86-hw user.notice Dpd: 9502:Col\_Line I {[00:47:37] Ixd202Cc.cpp:514}ZTR: Ixd-1 :ConfigIgcc:ConfigIgcc for pif: 0 As you can see the two logs have different IP and I want to visualize in Timelion two series one of each IP address which has keyword ZTR. Something like this- .es(q=ztr AND NodeIP:10.100.213.171).color(red) .es(q=ztr AND NodeIP:10.100.216.159).color(black) But this doesn't work. ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [August 3, 2017, 12:12pm UTC](https://discuss.elastic.co/t/kibana-timelion/95610/2 "2017-08-03T12:12:57Z")
@ashvita try wrapping your `q=` value in double quotes like so: `.es(q="ztr AND NodeIP:10.100.213.171").color(red) .es(q="ztr AND NodeIP:10.100.216.159").color(black)` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 31, 2017, 12:13pm UTC](https://discuss.elastic.co/t/kibana-timelion/95610/3 "2017-08-31T12:13:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.