# Newbie question: Timelion metric/split

**URL:** <https://discuss.elastic.co/t/newbie-question-timelion-metric-split/125769>\
**Category:** Kibana\
**Tags:** timelion\
**Created:** [March 27, 2018, 2:00pm UTC](https://discuss.elastic.co/t/newbie-question-timelion-metric-split/125769 "2018-03-27T14:00:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Julzor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/julzor/32/43931_2.png) [@Julzor](https://discuss.elastic.co/u/Julzor)\
**Post date:** [March 27, 2018, 2:00pm UTC](https://discuss.elastic.co/t/newbie-question-timelion-metric-split/125769/1 "2018-03-27T14:00:37Z")

</div>

Hi,

I'm new to Kibana and i'am struggling on a -maybe- simple thing.

I have this Timelion graph' :

`.**es(index="netflow-*", metric="sum:netflow.bytes", split="netflow.src_port_name:10", kibana=true)**.scale_interval(1s).fit(mode=scale).if(operator="lt", if=0, then=0).trim(start=2,end=1).label(regex="^.* netflow.src_port_name:(.+) > .*$", label="$1").lines(width=1, stack=true, fill=10, steps=true).yaxis(label="bytes / sec", min=0)`

This show me a graph' of my Netflow informations. It **aggregates on netflow.bytes** and **split on src\_port\_name:10** , keeping only the top 10.

The problem is that in my top 10 i have the 10 protocols that "appears" the most in the index, but i would like the top 10 protocols in terms of Bytes (so after the aggregation).

It means that if i do a single connection on an unusual port with a LOT of trafic (Bytes), it will only generate a single flow (= log line) and i won't appear on the top 10. On the other hands, protocols that are doing a lot of flows (eg DNS) but very few Bytes will appear in the top 10.

If someone understand the issue, i would like to get advices to have the correct behavior 🙂

Thank you

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [March 27, 2018, 10:35pm UTC](https://discuss.elastic.co/t/newbie-question-timelion-metric-split/125769/2 "2018-03-27T22:35:55Z")

</div>

Hi, this is about having the buckets of a terms aggregation sorted by a metric sub-aggtregation instead of the doc\_count of the bucket. Unfortunately, Timelion does not support this at the moment.

However, the Time Series Visual Builder visualization can do this. Note how I'm able to order by "Sum of metric":

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/1/a18a8309610b72e53add9a316287420150ecfb08.png)

BTW TSVB just uses aggregation features of Elasticsearch to do this. A raw Elasticsearch query for data ordered like this looks like:

```auto
POST /metrics/_search
{
  "aggs": {
    "cats": {
      "terms": {
        "field": "cat",
        "size": 10,
        "order": {
          "metric_sum": "desc"
        }
      },
      "aggs": {
        "metric_sum": {
          "sum": {
            "field": "metric"
          }
        }
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![Julzor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/julzor/32/43931_2.png) [@Julzor](https://discuss.elastic.co/u/Julzor)\
**Post date:** [March 28, 2018, 6:30am UTC](https://discuss.elastic.co/t/newbie-question-timelion-metric-split/125769/3 "2018-03-28T06:30:03Z")

</div>

Hi,

Thank you for your reply.

It's sad that Timelion doesn't support it, it looks quite simple.. Hope it'll be supported in the future.

Your solution looks promising, now i have the right Top 10 with TSVB!

But i still have a problem : "sum:netflow.bytes" just compute the total of bytes per protocols. After that, i would like to get the bytes\*\*/seconds\*\*. Since my interval is 1minute, i must divide the values by 60.  
In Timelion, this is done by **.scale\_interval(1s)**, but i don't find the equivalent in TSVB.

I would also like to transform those Bytes/sec into Bits/sec.

Is there a way to do this in TSVB? I tried Custom Data Formatter with Numeral.js operation like .divide() but it doesn't seems to work.

Thanks a lot!!! 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 25, 2018, 6:30am UTC](https://discuss.elastic.co/t/newbie-question-timelion-metric-split/125769/4 "2018-04-25T06:30:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.