Timelion confusion between what's shown and what's in ES

[Jean-Charle_Passepon (Jean Charle Passepont)]

Hello,

I'm trying to analyse some latency in my system with different timestamps received.

In timelion I can see that after some zooming:

which correspond to this time lapse:

But, in the discover area, this time lapse return no results at all.

Any ideas what's happening? Thanks!

[a5a (Archana)]

Hi Jean,

Timelion doesn’t use the index pattern selected in Discover. It needs to be specified in advanced settings or in the timelion expression itself. Maybe you're looking at different indices in each app?

[Jean-Charle_Passepon (Jean Charle Passepont)]

Hello a5a,

Thank you for your answer!
It is logs from logstash-* index that I'm visualising.

Thus I'm very surprised about the render compare to the discovery (both for logstash-* index).

[a5a (Archana)]

Hmm. Something else must be going on. I'm pinging @Bargs for more insight into this.

[Bargs (Matt Bargar)]

Are you using the same time field in Discover and Timelion? This is also configured separately in Timelion, either in the expression or in advanced settings