Timelion - is there a less redundant way?

Elastic Stack Kibana
1

I'm experimenting with timelion and I'm wondering whether there is a way to express this less redundant:

.es(
  split=tenant_name.keyword:10,
  timefield=date,
  metric=sum:spam_complaints
)
.divide(
  .es(
    split=tenant_name.keyword:10,
    timefield=date,
    metric=sum:total_volume
  )
)
.multiply(100)

Is there a way to define the split and the timefield at one location?

BTW: Why do I have to explicitly give the timefield? If I don't I get no data or even an error message

Error in visualization
[timelion_vis] > Timelion request error: Error: in cell #1: Cannot read property 'data' of undefined Error: in cell #1: Cannot read property 'data' of undefined

BTW #2: Why are linebreaks (for readability) not possible in the expression field?

2

Hi @Skeeve
unfortunately you can't define the split and timefield somewhere else, but it will be a good enhancement (if you want you can open an enhancement request here: https://github.com/elastic/kibana/issues/new?template=Feature_request.md)
The timefield is required because timelion doesn't know what field to use to compute the date histogram aggregation, or better it knows it but if you have multiple date fields it doesn't know what to choose (but I'm also pretty sure that timelion doesn't automatically select a timefield if you only have one timefield on your index).
About the linebreaks, I think you can add line breaks within each expression function, also also between functions (in this case seems that the line break can be done only using space, that will break to a new line the function

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.