# Timelion. Different timefield ranges for each query

**URL:** https://discuss.elastic.co/t/timelion-different-timefield-ranges-for-each-query/147811
**Category:** Kibana
**Tags:** timelion
**Created:** [September 8, 2018, 11:35am UTC](https://discuss.elastic.co/t/timelion-different-timefield-ranges-for-each-query/147811 "2018-09-08T11:35:54Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Tanatos\_Daniel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tanatos_daniel/32/20893_2.png) [@Tanatos\_Daniel](https://discuss.elastic.co/u/Tanatos_Daniel)
#### Post date: [September 8, 2018, 11:35am UTC](https://discuss.elastic.co/t/timelion-different-timefield-ranges-for-each-query/147811/1 "2018-09-08T11:35:54Z")

</div>

I have these records for 1961-2016 period. I have plotted the data corresponding to the 7th month for the entire period, together with the average aggregation for the same period.

Query:

`.es(q="month:7", index=1961-2016*, timefield="@timestamp", metric='avg:T').label("Values each year from 1961 to 2016"), .es(q="month:7", index=1961-2016*, timefield="@timestamp", metric='avg:T').aggregate('avg').label("Average 1961-2016")`

Plot:

 ![New%20Bitmap%20Image%20(2)](https://us1.discourse-cdn.com/elastic/original/3X/3/2/324af614417b80a237088a1994fe807308dfeb7e.jpeg)

But what I would actually want to do is to compare the evolution through the entire period with the average of a smaller timerange - 1961 TO 1990

This is what I tried (query):  
`.es(q="month:7", index=1961-2016*, timefield="@timestamp", metric='avg:T').label("Values each year from 1961 to 2016"), .es(q="month:7 AND year:[1961 TO 1990]", index=1961-2016*, timefield="@timestamp", metric='avg:T').aggregate('avg').label("Average 1961-1990")`  
And this is what I'm obtaining (plot):

 ![New%20Bitmap%20Image%20(2)](https://us1.discourse-cdn.com/elastic/original/3X/c/4/c43ca0f27231f03a95371e7dbe9be0f23273ae12.jpeg)

Changing the query from `q="month:7 AND year:[1961 TO 1990]"` to `q="month:7 AND year:[1961 TO 2016]"` displays correct. So the problem would be that the average aggregation is calculate by dividing it to the number of years in the whole timespan, not to the number of years from the query I added.

Is there any way of accomplishing what I want? Thank you,

---

<div class="post-metadata">

### Author: ![Tanatos\_Daniel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tanatos_daniel/32/20893_2.png) [@Tanatos\_Daniel](https://discuss.elastic.co/u/Tanatos_Daniel)
#### Post date: [September 8, 2018, 3:40pm UTC](https://discuss.elastic.co/t/timelion-different-timefield-ranges-for-each-query/147811/2 "2018-09-08T15:40:33Z")

</div>

Found something that looks like what I need here: [https://discuss.elastic.co/t/how-to-create-time-range-conditions-on-timelion/119404](https://discuss.elastic.co/t/how-to-create-time-range-conditions-on-timelion/119404) but could not make it work. Not sure how the query should look like.

I changed the `timelion:es.timefield` Kibana advanced setting (Management -\> Advanced Settings) with the string `insert_date` and then to other timestamp field I have - `DATM`, but did not manage to get anything.

I tried this query:  
`.es(q="month:7 AND DATM:[2016/10/01 TO 2016/12/31]", index=1961-2016*, timefield="DATM", metric='avg:T').label("Values each year from 1961 to 2016"),`  
`.es(q="month:7 AND DATM:[1961/01/01 TO 1990/12/31]", index=1961-2016*, timefield="DATM", metric='avg:T').aggregate('avg').label("Average 1961-1990")`

But does not near the first representation.

---

<div class="post-metadata">

### Author: ![rashid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashid/32/12566_2.png) [@rashid](https://discuss.elastic.co/u/rashid)
#### Post date: [September 10, 2018, 9:52pm UTC](https://discuss.elastic.co/t/timelion-different-timefield-ranges-for-each-query/147811/3 "2018-09-10T21:52:37Z")

</div>

Unfortunately I don't think this is possible currently. In theory you could null out 0s if `.if(eq,0,null)`, though that would depends on you knowing for sure that there are no 0 years, and rather a 0 represents an excluded year.

The crux of the issue is that the `aggregate()` function is treating `null` as `0`. You'd need to write a new function that doesn't do that.

You could also consider filing a bug, it seems like aggregate shouldn't treat `null` as `0`

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 8, 2018, 9:52pm UTC](https://discuss.elastic.co/t/timelion-different-timefield-ranges-for-each-query/147811/4 "2018-10-08T21:52:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
