TimeLion basic question

(Queenstownswords) #1


Please excuse, there is not a timelion category yet.

I am new to elasticsearch/kibana so thanks for your patience.
There is an index 'testindexname' with entries in the following format:
{"_index":"testindexname","_type":"datecount","_id":"201612022249","_version":1,"found":true,"_source":{ "clientId" : "1", "date" : "2016-12-02", "count" : 37857.0 }}

I can see the visualisations fine in kibana's 'visualize' and 'dashboard'.

However, es(*) only gives a value of 0 for the timeline.
The following es() arguments have been tried without change:

  • es(index='testindexname')
  • es(metric='sum:count')
  • es(q=clientId:1)
  • and a combination of the parameters.

Changing the date window (tried 5y, 2y, 1y, 30d, etc.) does not help.

What am I missing?

Note: for an end result, I would like to index multiple client ids (1, 2, ...) and graph in timelion a line for each graph.
I do not know if it is cleaner to put each client id in a separate index or to use one index for multiple client ids.

Thanks for your time.

(Mark Walkom) #2

You need to set your timefield.

(Queenstownswords) #3

@warkolm Many thanks. That got it.

If there is any insight as to why it would be 'date' instead of '@date' that would also be helpful- or any other resource as google/youtube are only somewhat helpful.

(Mark Walkom) #4

Because that is what you passed to ES.

@-prefixed fields are used by Logstash, but they aren't reserved.

(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.