Split in Timelion

Elastic Stack Kibana
1

Hi, I am trying to use split in Kibana/Timelion. I am not being able to split by term when I use the parameter .es(split:"foo.bar:10"). Note here: foo.bar is a nested field in my document. Is this a known issue? I am no Kibana 4.5.4.

Further, is it, in this or the latest Kibana version, possible to split by data histogram (like the Line Chart allows), much like group by days for the splits?

Also do divides and other chain-able methods honor the split? For example can I do something like .es(index='foo', metric='sum:field1', split='split_field:10').divide(.es(index='foo', metric='sum:field2', split='split_field:10')) to get the sum(field1)/sum(field2) split by split_field?

2

hi @vineetgoel,

as for your second question, yes, timelion respects the chaining on the splits.

As for your first question, how are your documents stored in ES? Can you share some examples of mapping with example documents?

3

Wait, so if I do .es(index='foo', metric='sum:field1', split='split_field:10').divide(.es(index='foo', metric='sum:field2')) will it divide the correct series split by split_field from the numerator and denominator? That doesn't seem the behavior I am getting. It is basically using the entire series (not split by split_field) in the denominator and only splitting in the numerator.