# Timelion Count is Incorrect **URL:** \ **Category:** Kibana\ **Tags:** timelion\ **Created:** [April 18, 2019, 6:44pm UTC](https://discuss.elastic.co/t/timelion-count-is-incorrect/177528 "2019-04-18T18:44:54Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![AddChickpeas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/addchickpeas/32/44414_2.png) [@AddChickpeas](https://discuss.elastic.co/u/AddChickpeas)\ **Post date:** [April 18, 2019, 6:44pm UTC](https://discuss.elastic.co/t/timelion-count-is-incorrect/177528/1 "2019-04-18T18:44:54Z")
I was playing around with a very simple Timelion graph and am perplexed by some of the results. The interval window is set to 30m: // .es(index=myindex-\*, q="Failed to log on", timefield=@timestamp).lines() When I make this same visualization in Kibana (using Area, Table, Visual Editor, or looking in Discover), I get different results from Timelion. The main thing being that Timelion has two large spikes which are not present in the Kibana ones. Any ideas what could be causing this? I found [this thread](https://discuss.elastic.co/t/timelion-count/92886/18) here about a similar issue, but no solution was found. **Timelion Visualization** - Query is a little different than above since I was playing around with syntax to see if it made a difference (it didn't) ![chrome_2019-04-17_16-46-26](https://us1.discourse-cdn.com/elastic/original/3X/4/b/4b2434021c57fa65a66e26bcad8c1acffa84cb5a.png) **Discover Graph** ![chrome_2019-04-17_17-01-32](https://us1.discourse-cdn.com/elastic/original/3X/2/a/2ad0c4bacfe15778544b601ad3253539ee0ccc5d.png) **Kibana Area Visualization** ![chrome_2019-04-17_16-47-51](https://us1.discourse-cdn.com/elastic/original/3X/7/e/7e00585a49a24c4c9081cb7d123ce0fdb647f551.png) ---
**Author:** ![joshdover](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshdover/32/42020_2.png) [@joshdover](https://discuss.elastic.co/u/joshdover)\ **Post date:** [April 19, 2019, 9:29pm UTC](https://discuss.elastic.co/t/timelion-count-is-incorrect/177528/2 "2019-04-19T21:29:18Z")
This is certainly strange. I've got a couple things we can try: - First make sure the queries are as close to the same as possible. For instance, in the Discover view and Area view I see you're using the default\_field for searching (because you don't specify a search field) where in the Timelion graph you are specifying the "message" field to filter on. Make sure these are the same in both to avoid any discrepancy by changing your search in Discover/Area to `message:"Failed to log on"`. If you also have this specified in the filter bar for your Timelion graph, you can remove it from the `.es()` expression. - If you're still seeing issues, turn on Elasticsearch query logging in Kibana's config and take a look at the logs. To do this: - Add `elasticsearch.logQueries: true` to your kibana.yml file - Start Kibana with the `--verbose=true` CLI argument (or `logging.verbose: true` in kibana.yml) - Test the queries that get logged when running the Area Visualization vs. Timelion Visualization. Is there any large difference in the query? If you run the queries manually do you see the same problem? If you get these queries out of the logs and post them here, I'm also happy to help diagnose what may be happening. Cheers! ---
**Author:** ![AddChickpeas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/addchickpeas/32/44414_2.png) [@AddChickpeas](https://discuss.elastic.co/u/AddChickpeas)\ **Post date:** [April 23, 2019, 4:17pm UTC](https://discuss.elastic.co/t/timelion-count-is-incorrect/177528/3 "2019-04-23T16:17:33Z")
Hi Josh, It looks like the issue did come down to syntax. In the instances that I did specify the message field in the Timelion query I had the quotation marks backwards. I had: ``` q="message:'An account failed to log on'" ``` Instead of: ``` q='message:"An account failed to log on"' ``` That said, it does look like Timelion processes queries with an unspecified search field differently than the typical area visualization. In the two instances below, the queries are identical, but produce different results: ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/b/0b6bd016b2d52226a7daed15afbccc1cfb003158.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/a/3a7d2176960f2c7b98d4279b33b13a49d4840652.png) Now, if I specify the message field they are the same: ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/b/2b806a89c619c22b9934f6b4c5d5db78bb1fca6e.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/9/89cd510e2fd1fea22f62a8811d16b53f3763b63c.png) Not sure if this is a bug or not. Regardless, specifying the field works around it so it looks like I'll be set with it! Thank you. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 21, 2019, 4:17pm UTC](https://discuss.elastic.co/t/timelion-count-is-incorrect/177528/4 "2019-05-21T16:17:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.