# Timelion bytes\_received and bytes\_sent counters graphs showing same results **URL:** \ **Category:** Kibana\ **Tags:** timelion\ **Created:** [August 3, 2017, 3:06pm UTC](https://discuss.elastic.co/t/timelion-bytes-received-and-bytes-sent-counters-graphs-showing-same-results/95735 "2017-08-03T15:06:14Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![danno](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danno/32/17152_2.png) [@danno](https://discuss.elastic.co/u/danno)\ **Post date:** [August 3, 2017, 3:06pm UTC](https://discuss.elastic.co/t/timelion-bytes-received-and-bytes-sent-counters-graphs-showing-same-results/95735/1 "2017-08-03T15:06:14Z")
I've created two timelion graphs based on fields "bytes\_recieved" (sp, i know) and "bytes\_sent". In the Kibana discovery results they clearly have different values when they aren't zero. But the created timeseries graphs show the same results: _(bytes\_sent is obscured by bytes\_received because their values are equal)_ ![timelion-prob-02](https://us1.discourse-cdn.com/elastic/original/3X/e/4/e4ca96337edd844b42c7b7117e66e20fa6538350.jpg) I don't understand what I'm doing wrong, when I view these counters in the Kibana Search Discovery results, they are clearly different values (_when non-zero or collection occurs at all_): ![timelion-prob-03](https://us1.discourse-cdn.com/elastic/original/3X/3/e/3ed94420b787dd2e19505806e9859dd93ee94ff0.jpg) It seems to draw the same data regardless of the field specified in the search- what am I missing? ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [August 3, 2017, 3:32pm UTC](https://discuss.elastic.co/t/timelion-bytes-received-and-bytes-sent-counters-graphs-showing-same-results/95735/2 "2017-08-03T15:32:37Z")
@danno you're using the `count` aggregation which doesn't work on a specific field. If you change `metric='count:bytes_sent'` to `metric='sum:bytes_sent'` you should get what you're looking for. Timelion should be throwing an error when you try to specify a field to use with the count aggregation, would you mind filing an issue for that [here](https://github.com/elastic/kibana/issues/new) ---
**Author:** ![danno](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danno/32/17152_2.png) [@danno](https://discuss.elastic.co/u/danno)\ **Post date:** [August 3, 2017, 3:36pm UTC](https://discuss.elastic.co/t/timelion-bytes-received-and-bytes-sent-counters-graphs-showing-same-results/95735/3 "2017-08-03T15:36:45Z")
You are correct, sir! They show different values now, thank-you very much! ---
**Author:** ![danno](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danno/32/17152_2.png) [@danno](https://discuss.elastic.co/u/danno)\ **Post date:** [August 3, 2017, 3:54pm UTC](https://discuss.elastic.co/t/timelion-bytes-received-and-bytes-sent-counters-graphs-showing-same-results/95735/4 "2017-08-03T15:54:43Z")
Actually, I think what really works best after some more tinkering is _cardinality_- `.es(q='type:fortigate',metric='cardinality:bytes_sent').color(#f66).label('bits sent'),.es('type:fortigate',metric='cardinality:bytes_recieved').label("bytes received")` ![timelion-prob-04](https://us1.discourse-cdn.com/elastic/original/3X/1/8/18ea6bf8eacb921fbe1302747a2b53a825df9954.jpg) Thank-you for shaking my mind of off 'count'! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 31, 2017, 3:55pm UTC](https://discuss.elastic.co/t/timelion-bytes-received-and-bytes-sent-counters-graphs-showing-same-results/95735/5 "2017-08-31T15:55:02Z")
Closed on August 31, 2017, 3:55pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.