Timelion bytes_received and bytes_sent counters graphs showing same results

[danno (Dan Farrell)]

I've created two timelion graphs based on fields "bytes_recieved" (sp, i know) and "bytes_sent". In the Kibana discovery results they clearly have different values when they aren't zero. But the created timeseries graphs show the same results:

(bytes_sent is obscured by bytes_received because their values are equal)

I don't understand what I'm doing wrong, when I view these counters in the Kibana Search Discovery results, they are clearly different values (when non-zero or collection occurs at all):

It seems to draw the same data regardless of the field specified in the search- what am I missing?

[Brandon_Kobel]

@danno you're using the count aggregation which doesn't work on a specific field. If you change metric='count:bytes_sent' to metric='sum:bytes_sent' you should get what you're looking for. Timelion should be throwing an error when you try to specify a field to use with the count aggregation, would you mind filing an issue for that here

[danno (Dan Farrell)]

You are correct, sir!
They show different values now, thank-you very much!

[danno (Dan Farrell)]

Actually, I think what really works best after some more tinkering is cardinality-

.es(q='type:fortigate',metric='cardinality:bytes_sent').color(#f66).label('bits sent'),.es('type:fortigate',metric='cardinality:bytes_recieved').label("bytes received")

Thank-you for shaking my mind of off 'count'!