Maximum timelion splits

I'm trying to draw a timelion with one line per host (field name is 'instance.keyword'), and have 26 hosts. It's a lot of lines, but it's useful in spotting hosts that have high values. Unfortunately, it only displays 24 values. The host names are IC1_MS01 through IC1_MS26, and I see IC1_MS01 through IC1_MS24. Is there a maximum number of splits? I can't find it in the docs, or in settings. My timelion expression is:

.es(index=gc-, q="instance.keyword:IC1_MS",metric=sum:collection_time,split=instance.keyword:26).legend(columns=3).label("$1","^.* >.keyword:(\S+) > .")

There shouldn't be a limit like this. Can you verify there is actually data present in the time range and the index pattern you are looking at for hosts 25 and 26?

Thanks. That's what it was - filebeat had a problem with those two hosts. I did run into a limit around 33, but I can work around that.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.