Split Timelion view based on Field

(Hari Viswadeep) #1


I have an Index "school"

Each record in "School" is like
finance_dept: {
"budget" : $10000
"spend" : $5000
"money_left" : $5000

How to show "budget", "spend" & "money_left" in a single Timelion graph

(Hari Viswadeep) #2

What is cardinatity ?


(Tim Sullivan) #3


In Timelion, you can show multiple data series in a chart by making multiple expressions separated by a space. For example, to show "spend" vs "money_left", you would do:

.es(metric=min:money_left) .es(metric=sum:spend)

It is a type of aggregation built into Elasticsearch to get the number of unique values for a field: https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-cardinality-aggregation.html

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.