# Timelion count

**URL:** https://discuss.elastic.co/t/timelion-count/92886
**Category:** Kibana
**Tags:** timelion
**Created:** [July 12, 2017, 10:07pm UTC](https://discuss.elastic.co/t/timelion-count/92886 "2017-07-12T22:07:02Z")
**Posts on this page:** 20
**Page:** 1

<div class="post-metadata">

### Author: ![Amit2015](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@Amit2015](https://discuss.elastic.co/u/Amit2015)
#### Post date: [July 12, 2017, 10:07pm UTC](https://discuss.elastic.co/t/timelion-count/92886/1 "2017-07-12T22:07:02Z")

</div>

I am using timelion. Using timelion doing sum for particular field. There is no logs from last 2 days though its showing count number. When I am using simple query: .es(index="abc-2017.07")  
It should give 0 count but it's showing value.

Please suggest...

Thanks!

---

<div class="post-metadata">

### Author: ![Amit2015](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@Amit2015](https://discuss.elastic.co/u/Amit2015)
#### Post date: [July 12, 2017, 10:32pm UTC](https://discuss.elastic.co/t/timelion-count/92886/2 "2017-07-12T22:32:51Z")

</div>

In Kibana Discover there is no logs and count is 0 but in Timelion showing count value for same index.

---

<div class="post-metadata">

### Author: ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)
#### Post date: [July 13, 2017, 2:40pm UTC](https://discuss.elastic.co/t/timelion-count/92886/3 "2017-07-13T14:40:16Z")

</div>

Is your selected time range in the timepicker (top right corner) the same between Discover and Timelion? Your selection in Discover won't automatically persist when switching to Timelion, which sometimes trips people up.

---

<div class="post-metadata">

### Author: ![Amit2015](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@Amit2015](https://discuss.elastic.co/u/Amit2015)
#### Post date: [July 13, 2017, 4:39pm UTC](https://discuss.elastic.co/t/timelion-count/92886/4 "2017-07-13T16:39:59Z")

</div>

Hi Bargs,

Thanks for reply! Time range is same selected for Discover and Timlion though Timelion have counts and Dscover don't have anything. Even Source folder is not containing any logs. I have checked there is no other source for that index.

---

<div class="post-metadata">

### Author: ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)
#### Post date: [July 13, 2017, 4:56pm UTC](https://discuss.elastic.co/t/timelion-count/92886/5 "2017-07-13T16:56:44Z")

</div>

Hmm, and you're querying the same index pattern in both Discover and Timelion? In other words, if you're looking at index pattern `logstash-*` in Discover, your Timelion query looks like `.es(index="logstash-*")`?

---

<div class="post-metadata">

### Author: ![Amit2015](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@Amit2015](https://discuss.elastic.co/u/Amit2015)
#### Post date: [July 13, 2017, 5:07pm UTC](https://discuss.elastic.co/t/timelion-count/92886/6 "2017-07-13T17:07:39Z")

</div>

Yes, using same index pattern i.e abc-\* in Discover, .es(index="abc-\*") in Timelion

---

<div class="post-metadata">

### Author: ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)
#### Post date: [July 13, 2017, 7:04pm UTC](https://discuss.elastic.co/t/timelion-count/92886/7 "2017-07-13T19:04:00Z")

</div>

Huh, odd. You can log timelion's queries by adding `elasticsearch.logQueries: true` to your kibana.yml and starting kibana with the `--verbose` flag. You can see the queries Discover is generating by looking at the network tab of your browser's dev tools (look for the `_msearch` request). Could you grab both of those and compare them? The timelion query _should_ contain a range filter representing the time period selected in the time picker.

---

<div class="post-metadata">

### Author: ![Amit2015](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@Amit2015](https://discuss.elastic.co/u/Amit2015)
#### Post date: [July 17, 2017, 7:00pm UTC](https://discuss.elastic.co/t/timelion-count/92886/8 "2017-07-17T19:00:15Z")

</div>

Hi I have attached both screenshots - Discover and Timlion:

 ![](https://us1.discourse-cdn.com/elastic/original/3X/8/c/8c9f426337e35bad2be2513be49b3da4bb00a54e.png)

 ![](https://us1.discourse-cdn.com/elastic/original/3X/5/2/5295db83dfdf6398ad9845911c798f6b5d030621.png)

In kibana.yml have added elasticsearch.logQueries: true and start kibana with --verbose flag. Though its showing huge difference. Timelion and Discover is not matching, Timelion having count around 6500 and discover have around 150.

Please help...

Thanks!

---

<div class="post-metadata">

### Author: ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)
#### Post date: [July 18, 2017, 3:37pm UTC](https://discuss.elastic.co/t/timelion-count/92886/9 "2017-07-18T15:37:16Z")

</div>

Can you provide the raw queries from the logs that both Discover and Timelion are generating?

---

<div class="post-metadata">

### Author: ![Amit2015](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@Amit2015](https://discuss.elastic.co/u/Amit2015)
#### Post date: [July 19, 2017, 6:42pm UTC](https://discuss.elastic.co/t/timelion-count/92886/10 "2017-07-19T18:42:30Z")

</div>

Jul 19 11:21:48 Kibana1 kibana[17307]: {"type":"response","@timestamp":"2017-07-19T18:21:48Z","tags":[],"pid":17307,"method":"get","statusCode":304,"req":{"url":"/ui/favicons/favicon-32x32.png","method":"get","headers":{"host":"x.x.x.x:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36","accept":"image/webp,image/apng,image/_,_/_;q=0.8","referer":"[http://x.x.x.x:5601/app/timelion","accept-encoding":"gzip](http://x.x.x.x:5601/app/timelion%22,%22accept-encoding%22:%22gzip), deflate","accept-language":"en-US,en;q=0.8","if-none-match":""128bd421ef426ccdd9ea3293f79d25687b9832e7"","if-modified-since":"Mon, 29 May 2017 16:17:21 GMT"},"remoteAddress":"x.x.x.x","userAgent":"x.x.x.x","referer":"[http://x.x.x.x:5601/app/timelion"},"res":{"statusCode":304,"responseTime":3,"contentLength":9},"message":"GET](http://x.x.x.x:5601/app/timelion%22%7D,%22res%22:%7B%22statusCode%22:304,%22responseTime%22:3,%22contentLength%22:9%7D,%22message%22:%22GET) /ui/favicons/favicon-32x32.png 304 3ms - 9.0B"}  
Jul 19 11:21:48 Kibana1 kibana[17307]: {"type":"response","@timestamp":"2017-07-19T18:21:48Z","tags":[],"pid":17307,"method":"get","statusCode":304,"req":{"url":"/ui/favicons/favicon-16x16.png","method":"get","headers":{"host":"x.x.x.x:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36","accept":"image/webp,image/apng,image/_,_/_;q=0.8","referer":"[http://x.x.x.x:5601/app/timelion","accept-encoding":"gzip](http://x.x.x.x:5601/app/timelion%22,%22accept-encoding%22:%22gzip), deflate","accept-language":"en-US,en;q=0.8","if-none-match":""f33f077bfe13045136046c93b6180be0379386ff"","if-modified-since":"Mon, 29 May 2017 16:17:21 GMT"},"remoteAddress":"x.x.x.x","userAgent":"x.x.x.x","referer":"[http://x.x.x.x:5601/app/timelion"},"res":{"statusCode":304,"responseTime":2,"contentLength":9},"message":"GET](http://x.x.x.x:5601/app/timelion%22%7D,%22res%22:%7B%22statusCode%22:304,%22responseTime%22:2,%22contentLength%22:9%7D,%22message%22:%22GET) /ui/favicons/favicon-16x16.png 304 2ms - 9.0B"}  
Jul 19 11:22:03 Kibana1 kibana[17307]: {"type":"response","@timestamp":"2017-07-19T18:22:03Z","tags":[],"pid":17307,"method":"get","statusCode":304,"req":{"url":"/ui/favicons/favicon-32x32.png","method":"get","headers":{"host":"x.x.x.x:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36","accept":"image/webp,image/apng,image/_,_/_;q=0.8","referer":"[http://x.x.x.x:5601/app/kibana","accept-encoding":"gzip](http://x.x.x.x:5601/app/kibana%22,%22accept-encoding%22:%22gzip), deflate","accept-language":"en-US,en;q=0.8","if-none-match":""128bd421ef426ccdd9ea3293f79d25687b9832e7"","if-modified-since":"Mon, 29 May 2017 16:17:21 GMT"},"remoteAddress":"x.x.x.x","userAgent":"x.x.x.x","referer":"[http://x.x.x.x:5601/app/kibana"},"res":{"statusCode":304,"responseTime":4,"contentLength":9},"message":"GET](http://x.x.x.x:5601/app/kibana%22%7D,%22res%22:%7B%22statusCode%22:304,%22responseTime%22:4,%22contentLength%22:9%7D,%22message%22:%22GET) /ui/favicons/favicon-32x32.png 304 4ms - 9.0B"}  
Jul 19 11:22:03 Kibana1 kibana[17307]: {"type":"response","@timestamp":"2017-07-19T18:22:03Z","tags":[],"pid":17307,"method":"get","statusCode":304,"req":{"url":"/ui/favicons/favicon-16x16.png","method":"get","headers":{"host":"x.x.x.x:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36","accept":"image/webp,image/apng,image/_,_/_;q=0.8","referer":"[http://x.x.x.x:5601/app/kibana","accept-encoding":"gzip](http://x.x.x.x:5601/app/kibana%22,%22accept-encoding%22:%22gzip), deflate","accept-language":"en-US,en;q=0.8","if-none-match":""f33f077bfe13045136046c93b6180be0379386ff"","if-modified-since":"Mon, 29 May 2017 16:17:21 GMT"},"remoteAddress":"x.x.x.x","userAgent":"x.x.x.x","referer":"[http://x.x.x.x:5601/app/kibana"},"res":{"statusCode":304,"responseTime":1,"contentLength":9},"message":"GET](http://x.x.x.x:5601/app/kibana%22%7D,%22res%22:%7B%22statusCode%22:304,%22responseTime%22:1,%22contentLength%22:9%7D,%22message%22:%22GET) /ui/favicons/favicon-16x16.png 304 1ms - 9.0B"}  
Jul 19 11:22:03 Kibana1 kibana[17307]: {"type":"response","@timestamp":"2017-07-19T18:22:03Z","tags":[],"pid":17307,"method":"post","statusCode":200,"req":{"url":"/elasticsearch/\_msearch","method":"post","headers":{"host":"x.x.x.x:5601","connection":"keep-alive","content-length":"957","accept":"application/json, text/plain, _/_","origin":"[http://x.x.x.x:5601](http://x.x.x.x:5601)","kbn-version":"5.4.1","user-agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36","content-type":"application/x-ndjson","referer":"[http://x.x.x.x:5601/app/kibana","accept-encoding":"gzip](http://x.x.x.x:5601/app/kibana%22,%22accept-encoding%22:%22gzip), deflate","accept-language":"en-US,en;q=0.8"},"remoteAddress":"x.x.x.x","userAgent":"x.x.x.x","referer":"[http://x.x.x.x:5601/app/kibana"},"res":{"statusCode":200,"responseTime":179,"contentLength":9},"message":"POST](http://x.x.x.x:5601/app/kibana%22%7D,%22res%22:%7B%22statusCode%22:200,%22responseTime%22:179,%22contentLength%22:9%7D,%22message%22:%22POST) /elasticsearch/\_msearch 200 179ms - 9.0B"}  
Jul 19 11:22:08 Kibana1 kibana[17307]: {"type":"response","@timestamp":"2017-07-19T18:22:08Z","tags":[],"pid":17307,"method":"get","statusCode":304,"req":{"url":"/ui/favicons/favicon-32x32.png","method":"get","headers":{"host":"x.x.x.x:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36","accept":"image/webp,image/apng,image/_,_/_;q=0.8","referer":"[http://x.x.x.x:5601/app/kibana","accept-encoding":"gzip](http://x.x.x.x:5601/app/kibana%22,%22accept-encoding%22:%22gzip), deflate","accept-language":"en-US,en;q=0.8","if-none-match":""128bd421ef426ccdd9ea3293f79d25687b9832e7"","if-modified-since":"Mon, 29 May 2017 16:17:21 GMT"},"remoteAddress":"x.x.x.x","userAgent":"x.x.x.x","referer":"[http://x.x.x.x:5601/app/kibana"},"res":{"statusCode":304,"responseTime":2,"contentLength":9},"message":"GET](http://x.x.x.x:5601/app/kibana%22%7D,%22res%22:%7B%22statusCode%22:304,%22responseTime%22:2,%22contentLength%22:9%7D,%22message%22:%22GET) /ui/favicons/favicon-32x32.png 304 2ms - 9.0B"}  
Jul 19 11:22:08 Kibana1 kibana[17307]: {"type":"response","@timestamp":"2017-07-19T18:22:08Z","tags":[],"pid":17307,"method":"post","statusCode":200,"req":{"url":"/elasticsearch/\_msearch","method":"post","headers":{"host":"x.x.x.x:5601","connection":"keep-alive","content-length":"957","accept":"application/json, text/plain, /","origin":"[http://x.x.x.x:5601](http://x.x.x.x:5601)","kbn-version":"5.4.1","user-agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36","content-type":"application/x-ndjson","referer":"[http://x.x.x.x:5601/app/kibana","accept-encoding":"gzip](http://x.x.x.x:5601/app/kibana%22,%22accept-encoding%22:%22gzip), deflate","accept-language":"en-US,en;q=0.8"},"remoteAddress":"x.x.x.x","userAgent":"x.x.x.x","referer":"[http://x.x.x.x:5601/app/kibana"},"res":{"statusCode":200,"responseTime":8,"contentLength":9},"message":"POST](http://x.x.x.x:5601/app/kibana%22%7D,%22res%22:%7B%22statusCode%22:200,%22responseTime%22:8,%22contentLength%22:9%7D,%22message%22:%22POST) /elasticsearch/\_msearch 200 8ms - 9.0B"}  
Jul 19 11:22:08 Kibana1 kibana[17307]: {"type":"response","@timestamp":"2017-07-19T18:22:08Z","tags":[],"pid":17307,"method":"get","statusCode":304,"req":{"url":"/ui/favicons/favicon-16x16.png","method":"get","headers":{"host":"x.x.x.x:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36","accept":"image/webp,image/apng,image/_,_/_;q=0.8","referer":"[http://x.x.x.x:5601/app/kibana","accept-encoding":"gzip](http://x.x.x.x:5601/app/kibana%22,%22accept-encoding%22:%22gzip), deflate","accept-language":"en-US,en;q=0.8","if-none-match":""f33f077bfe13045136046c93b6180be0379386ff"","if-modified-since":"Mon, 29 May 2017

---

<div class="post-metadata">

### Author: ![Amit2015](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@Amit2015](https://discuss.elastic.co/u/Amit2015)
#### Post date: [July 19, 2017, 7:07pm UTC](https://discuss.elastic.co/t/timelion-count/92886/11 "2017-07-19T19:07:39Z")

</div>

Timlion is showing wrong count. How to solve it? Please help

---

<div class="post-metadata">

### Author: ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)
#### Post date: [July 19, 2017, 8:41pm UTC](https://discuss.elastic.co/t/timelion-count/92886/12 "2017-07-19T20:41:48Z")

</div>

That shows the request log, but not the actual Elasticsearch request body. Did you add `elasticsearch.logQueries: true` to your kibana.yml and start Kibana with `--verbose`?

For Timelion for example, you should see a log line that looks something like this:

```auto
POST /_all/_search
{"query":{"bool":{"must":[{"range":{"@timestamp":{"gte":1500495836274,"lte":1500496736274,"format":"epoch_millis"}}}]}},"aggs":{"q":{"meta":{"type":"split"},"filters":{"filters":{"*":{"query_string":{"query":"*"}}}},"aggs":{"time_buckets":{"meta":{"type":"time_buckets"},"date_histogram":{"field":"@timestamp","interval":"1s","time_zone":"America/New_York","extended_bounds":{"min":1500495836274,"max":1500496736274},"min_doc_count":0},"aggs":{"count":{"bucket_script":{"buckets_path":"_count","script":{"inline":"_value","lang":"expression"}}}}}}}},"size":0}
server respons [20:38:56.407] POST /api/timelion/run 200 151ms - 9.0B

```

---

<div class="post-metadata">

### Author: ![Amit2015](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@Amit2015](https://discuss.elastic.co/u/Amit2015)
#### Post date: [July 19, 2017, 8:44pm UTC](https://discuss.elastic.co/t/timelion-count/92886/13 "2017-07-19T20:44:24Z")

</div>

Hi,

I have added elasticsearch.logQueries: true into kibana.yml and started Kibana with --verbose. Checked logs from /var/log/syslog.

---

<div class="post-metadata">

### Author: ![Amit2015](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@Amit2015](https://discuss.elastic.co/u/Amit2015)
#### Post date: [July 19, 2017, 8:51pm UTC](https://discuss.elastic.co/t/timelion-count/92886/14 "2017-07-19T20:51:08Z")

</div>

Jul 19 09:27:49 Kibana1 kibana[17307]: {"type":"response","@timestamp":"2017-07-19T16:27:49Z","tags":[],"pid":17307,"method":"get","statusCode":304,"req":{"url":"/plugins/timelion/icon.svg","method":"get","headers":{"host":"x.x.x.x:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36","accept":"image/webp,image/apng,image/_,_/_;q=0.8","referer":"[http://x.x.x.x:5601/app/kibana","accept-encoding":"gzip](http://x.x.x.x:5601/app/kibana%22,%22accept-encoding%22:%22gzip), deflate","accept-language":"en-US,en;q=0.8","if-none-match":""cb793d5314d680b7d5ce130f0393a70b51989541-gzip"","if-modified-since":"Mon, 29 May 2017 16:17:21 GMT"},"remoteAddress":"10.253.96.172","userAgent":"10.253.96.172","referer":"[http://x.x.x.x:5601/app/kibana"},"res":{"statusCode":304,"responseTime":3,"contentLength":9},"message":"GET](http://x.x.x.x:5601/app/kibana%22%7D,%22res%22:%7B%22statusCode%22:304,%22responseTime%22:3,%22contentLength%22:9%7D,%22message%22:%22GET) /plugins/timelion/icon.svg 304 3ms - 9.0B"}  
Jul 19 09:27:49 Kibana1 kibana[17307]: {"type":"response","@timestamp":"2017-07-19T16:27:49Z","tags":[],"pid":17307,"method":"get","statusCode":304,"req":{"url":"/ui/fonts/open\_sans/open\_sans\_v13\_latin\_regular.woff2","method":"get","headers":{"host":"x.x.x.x:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36","origin":"[http://x.x.x.x:5601](http://x.x.x.x:5601)","accept":"_/_","referer":"[http://x.x.x.x:5601/app/kibana","accept-encoding":"gzip](http://x.x.x.x:5601/app/kibana%22,%22accept-encoding%22:%22gzip), deflate","accept-language":"en-US,en;q=0.8","if-none-match":""afc44700053c9a28f9ab26f6aec4862ac1d0795d"","if-modified-since":"Mon, 29 May 2017 16:17:21 GMT"},"remoteAddress":"10.253.96.172","userAgent":"10.253.96.172","referer":"[http://x.x.x.x:5601/app/kibana"},"res":{"statusCode":304,"responseTime":1,"contentLength":9},"message":"GET](http://x.x.x.x:5601/app/kibana%22%7D,%22res%22:%7B%22statusCode%22:304,%22responseTime%22:1,%22contentLength%22:9%7D,%22message%22:%22GET) /ui/fonts/open\_sans/open\_sans\_v13\_latin\_regular.woff2 304 1ms - 9.0B"}  
Jul 19 11:21:21 Kibana1 kibana[17307]: {"type":"response","@timestamp":"2017-07-19T18:21:21Z","tags":[],"pid":17307,"method":"get","statusCode":304,"req":{"url":"/plugins/kibana/assets/discover.svg","method":"get","headers":{"host":"x.x.x.x:5601","connection":"keep-alive","if-none-match":""c4035451a8e776d0f0cd354a825ec432ad06884e-gzip"","if-modified-since":"Mon, 29 May 2017 16:17:21 GMT","user-agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36","accept":"image/webp,image/apng,image/_,_/_;q=0.8","referer":"[http://x.x.x.x:5601/app/timelion","accept-encoding":"gzip](http://x.x.x.x:5601/app/timelion%22,%22accept-encoding%22:%22gzip), deflate","accept-language":"en-US,en;q=0.8"},"remoteAddress":"10.253.96.172","userAgent":"10.253.96.172","referer":"[http://x.x.x.x:5601/app/timelion"},"res":{"statusCode":304,"responseTime":1,"contentLength":9},"message":"GET](http://x.x.x.x:5601/app/timelion%22%7D,%22res%22:%7B%22statusCode%22:304,%22responseTime%22:1,%22contentLength%22:9%7D,%22message%22:%22GET) /plugins/kibana/assets/discover.svg 304 1ms - 9.0B"}  
Jul 19 11:21:21 Kibana1 kibana[17307]: {"type":"response","@timestamp":"2017-07-19T18:21:21Z","tags":[],"pid":17307,"method":"get","statusCode":304,"req":{"url":"/plugins/kibana/assets/visualize.svg","method":"get","headers":{"host":"x.x.x.x:5601","connection":"keep-alive","if-none-match":""4cc79a4d91bd0380d0c82a6b092f339d185670ef-gzip"","if-modified-since":"Mon, 29 May 2017 16:17:21 GMT","user-agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36","accept":"image/webp,image/apng,image/_,_/\*;q=0.8","referer":"[http://x.x.x.x:5601/app/timelion","accept-encoding":"gzip](http://x.x.x.x:5601/app/timelion%22,%22accept-encoding%22:%22gzip), deflate","accept-language":"en-US,en;q=0.8"},"remoteAddress":"10.253.96.172","userAgent":"10.253.96.172","referer":"[http://x.x.x.x:5601/app/timelion"},"res":{"statusCode":304,"responseTime":0,"contentLength":9},"message":"GET](http://x.x.x.x:5601/app/timelion%22%7D,%22res%22:%7B%22statusCode%22:304,%22responseTime%22:0,%22contentLength%22:9%7D,%22message%22:%22GET) /plugins/kibana/assets/visualize.svg 304 0ms - 9.0B"}

---

<div class="post-metadata">

### Author: ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)
#### Post date: [July 19, 2017, 8:58pm UTC](https://discuss.elastic.co/t/timelion-count/92886/15 "2017-07-19T20:58:01Z")

</div>

Did you restart Kibana after making those changes?

---

<div class="post-metadata">

### Author: ![Amit2015](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@Amit2015](https://discuss.elastic.co/u/Amit2015)
#### Post date: [July 19, 2017, 8:58pm UTC](https://discuss.elastic.co/t/timelion-count/92886/16 "2017-07-19T20:58:52Z")

</div>

Yes, I have restart Kibana.

---

<div class="post-metadata">

### Author: ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)
#### Post date: [July 19, 2017, 9:44pm UTC](https://discuss.elastic.co/t/timelion-count/92886/17 "2017-07-19T21:44:40Z")

</div>

Sorry, I'm not sure what's going on then. It seems like the config changes aren't taking effect. Can you confirm Kibana is reading the config file you changed and that the --verbose flag is in effect? You can also enable verbose logging in kibana.yml with `logging.verbose: true` if that helps.

---

<div class="post-metadata">

### Author: ![Amit2015](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@Amit2015](https://discuss.elastic.co/u/Amit2015)
#### Post date: [July 19, 2017, 9:56pm UTC](https://discuss.elastic.co/t/timelion-count/92886/18 "2017-07-19T21:56:29Z")

</div>

I have added in kibana.yml : logging.verbose: true and elasticsearch.logQueries: true. Timelion count is high we are getting 4-10 records but its showing 4000+ counts.

![](https://us1.discourse-cdn.com/elastic/original/3X/8/9/89284570a53fc941cb4479ac23da8abd999e51b0.png)

---

<div class="post-metadata">

### Author: ![Amit2015](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@Amit2015](https://discuss.elastic.co/u/Amit2015)
#### Post date: [July 28, 2017, 4:54pm UTC](https://discuss.elastic.co/t/timelion-count/92886/19 "2017-07-28T16:54:59Z")

</div>

Any solution to solve this problem?

---

<div class="post-metadata">

### Author: ![Amit2015](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@Amit2015](https://discuss.elastic.co/u/Amit2015)
#### Post date: [August 18, 2017, 5:13pm UTC](https://discuss.elastic.co/t/timelion-count/92886/20 "2017-08-18T17:13:53Z")

</div>

I have upgraded 5.4.1 to 5.5.1 still getting random counts in Timelion which is not matching with Discover/Visualization.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/e/4e414300eedeb02a5a48ba03a11a874945476c67.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/3/63ce8ad6cc621af2e1d373b9566bed3091a7614a.png)

In Timelion for last 4 hours count is around 900 but in discover for same index same time window count is 44. Please help me to solve this problem.

Thanks!

[Next page](https://discuss.elastic.co/t/timelion-count/92886.md?page=2)
