# Timelion expression Problem

**URL:** <https://discuss.elastic.co/t/timelion-expression-problem/234587>\
**Category:** Kibana\
**Tags:** timelion\
**Created:** [May 27, 2020, 4:34pm UTC](https://discuss.elastic.co/t/timelion-expression-problem/234587 "2020-05-27T16:34:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![olg32](https://avatars.discourse-cdn.com/v4/letter/o/35a633/32.png) [@olg32](https://discuss.elastic.co/u/olg32)\
**Post date:** [May 27, 2020, 4:34pm UTC](https://discuss.elastic.co/t/timelion-expression-problem/234587/1 "2020-05-27T16:34:54Z")

</div>

Hi,

I have a very basic question about Kibana's Timelion. I'm trying to create a visualization of Bytes arriving in a router's interface, I'm using Ntopng which I have configured to send data to ElasticSerch so I can visualize throughput with Kibana.

So far so good, I created an index called ntopng and I can see hits from this index in Timelion:

 ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/e/5/e5325e13549f112fa46222d5f2f89709978ffccf.jpeg)

The index provides several fields, like "IN\_BYTES" or "IN\_PKTS" which I'd like to use to generate traffic graphs:

 ![Capture2](https://us1.discourse-cdn.com/elastic/original/3X/b/2/b2cad7b3f9d10ad19933cec2161025d2596fa660.jpeg)

But if I add a query with the mentioned field, all I get is a flat line:

 ![Capture2](https://us1.discourse-cdn.com/elastic/original/3X/7/6/760daa210705f1ee5ab8f6cdd2f9563785876981.jpeg)

I'm sure there's something wrong with the Timelion expression, but as I'm still learning how to use Kibana, so I'm quite stuck.

Any help on how to visualize fields in Timelion would be appreciated.

Thanks.

---

<div class="post-metadata">

**Author:** ![olg32](https://avatars.discourse-cdn.com/v4/letter/o/35a633/32.png) [@olg32](https://discuss.elastic.co/u/olg32)\
**Post date:** [May 27, 2020, 11:06pm UTC](https://discuss.elastic.co/t/timelion-expression-problem/234587/2 "2020-05-27T23:06:08Z")

</div>

Ok,after researching I found I was missing timefield and metric parameters in the expression, now I see traffic from the field required.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 24, 2020, 11:06pm UTC](https://discuss.elastic.co/t/timelion-expression-problem/234587/3 "2020-06-24T23:06:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.