# Timelion help
**URL:** https://discuss.elastic.co/t/timelion-help/115621
**Category:** Kibana
**Tags:** timelion
**Created:** [January 16, 2018, 1:36am UTC](https://discuss.elastic.co/t/timelion-help/115621 "2018-01-16T01:36:40Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@kanthimathi](https://discuss.elastic.co/u/kanthimathi)
#### Post date: [January 16, 2018, 1:36am UTC](https://discuss.elastic.co/t/timelion-help/115621/1 "2018-01-16T01:36:40Z")
In Timelion i wanted to visualise cpu usage per pod. I am using metricbeats for this purpose.
```auto
.es(index=metricbeat-*, timefield='@timestamp', metric='avg:system.cpu.user.pct').label('current hour').title('CPU usage over time').color(#1E90FF)
```
when i use the above syntax, it pulls the cpu usage but is it possible for me to get cpu usage per agent, I tried using this command
```auto
.es(index=metricbeat-*, timefield='@timestamp', kibana='beat.name:###',metric='avg:system.cpu.user.pct').label('current hour').title('CPU usage over time').color(#1E90FF)
```
But this is pulling result for general one and not getting the specified metrics alone. I want to find the usage for each pod in kubernetes. Can somebody help?
Thnaks,
Kanthi.
---
### Author:  [@kanthimathi](https://discuss.elastic.co/u/kanthimathi)
#### Post date: [January 16, 2018, 7:52pm UTC](https://discuss.elastic.co/t/timelion-help/115621/3 "2018-01-16T19:52:46Z")
I need to find the cpu usage in timelion for the past hour. I tried changing the above statement event with q='beat.name:###' but it is getting cpu usage for the entire system
---
### Author:  [@spalger](https://discuss.elastic.co/u/spalger)
#### Post date: [January 16, 2018, 8:08pm UTC](https://discuss.elastic.co/t/timelion-help/115621/4 "2018-01-16T20:08:58Z")
Using `q=...` to filter each series to a specific pod should totally work. This example uses randomly generated web logs, but does effectively the same thing. It's possible your query isn't actually working, are you able to verify the query works in Discover?
---
### Author:  [@kanthimathi](https://discuss.elastic.co/u/kanthimathi)
#### Post date: [January 16, 2018, 8:22pm UTC](https://discuss.elastic.co/t/timelion-help/115621/5 "2018-01-16T20:22:38Z")
This is the query I used. However, in discover i can find the hits. I tried both with beat.name and beat.hostname.
Update: Playing around I found that the query works with metric='count:system.cpu.user.pct' but not avg
`.es(index=metricbeat-*, timefield='@timestamp', q="beat.hostname:k8s-agent-4CD4739E-24",metric='count:system.cpu.user.pct').label('current hour').title('CPU usage over time')`
---
### Author:  [@spalger](https://discuss.elastic.co/u/spalger)
#### Post date: [January 16, 2018, 11:12pm UTC](https://discuss.elastic.co/t/timelion-help/115621/6 "2018-01-16T23:12:03Z")
Can you try filtering by the metricset name too? `q="beat.hostname:k8s-agent-4CD4739E-24 AND metricset.name:cpu"` including data from other metric sets might cause lines not to render because data is missing. You might also want to try `.bars()` instead of lines, or using the `.fit()` function to define how timelion should draw lines between points that have `null` values between them.
---
### Author:  [@kanthimathi](https://discuss.elastic.co/u/kanthimathi)
#### Post date: [January 17, 2018, 1:50am UTC](https://discuss.elastic.co/t/timelion-help/115621/7 "2018-01-17T01:50:36Z")
works now 😃 Thank you 😄
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 14, 2018, 1:51am UTC](https://discuss.elastic.co/t/timelion-help/115621/8 "2018-02-14T01:51:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.