Maximum timelion splits

Elastic Stack Kibana
1

I'm trying to draw a timelion with one line per host (field name is 'instance.keyword'), and have 26 hosts. It's a lot of lines, but it's useful in spotting hosts that have high values. Unfortunately, it only displays 24 values. The host names are IC1_MS01 through IC1_MS26, and I see IC1_MS01 through IC1_MS24. Is there a maximum number of splits? I can't find it in the docs, or in settings. My timelion expression is:

.es(index=gc-, q="instance.keyword:IC1_MS",metric=sum:collection_time,split=instance.keyword:26).legend(columns=3).label("$1","^.* >.keyword:(\S+) > .")

2

There shouldn't be a limit like this. Can you verify there is actually data present in the time range and the index pattern you are looking at for hosts 25 and 26?

3

Thanks. That's what it was - filebeat had a problem with those two hosts. I did run into a limit around 33, but I can work around that.