# Timelion of kibana error : incomplete function
**URL:** https://discuss.elastic.co/t/timelion-of-kibana-error-incomplete-function/97230
**Category:** Kibana
**Tags:** timelion
**Created:** [August 16, 2017, 10:22am UTC](https://discuss.elastic.co/t/timelion-of-kibana-error-incomplete-function/97230 "2017-08-16T10:22:13Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@marwa](https://discuss.elastic.co/u/marwa)
#### Post date: [August 16, 2017, 10:22am UTC](https://discuss.elastic.co/t/timelion-of-kibana-error-incomplete-function/97230/1 "2017-08-16T10:22:13Z")
Hello ,
i am using timelion of kibana but this error appear
{"type":"incompleteFunction","function":"es","location":{"min":8,"max":11},"text":".es"}
this the query i wrote
.es(\*),.es(index='transaction",timefield="transaction\_date", metric="cardinality:customer\_name").substract(.es(index="transaction",metric="cardinality:customer\_name",offset ="-1M"))
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [August 16, 2017, 7:00pm UTC](https://discuss.elastic.co/t/timelion-of-kibana-error-incomplete-function/97230/2 "2017-08-16T19:00:46Z")
It looks like you're missing the `timefield=“transaction_date”` from the `.subtract(.es())` part.
```
You have;
.es(*),.es(index='transaction",timefield=“transaction_date”, metric=“cardinality:customer_name”).substract(.es(index=“transaction”,metric=“cardinality:customer_name”,offset ="-1M"))
but should be;
.es(*),.es(index='transaction",timefield=“transaction_date”, metric=“cardinality:customer_name”).substract(.es(index=“transaction”,timefield=“transaction_date”,metric=“cardinality:customer_name”,offset ="-1M"))
```
---
### Author:  [@marwa](https://discuss.elastic.co/u/marwa)
#### Post date: [August 17, 2017, 8:04am UTC](https://discuss.elastic.co/t/timelion-of-kibana-error-incomplete-function/97230/3 "2017-08-17T08:04:57Z")
> [@LeeDr](#):
>
> .es(\*),.es(index='transaction",timefield=“transaction\_date”, metric=“cardinality:customer\_name”).substract(.es(index=“transaction”,timefield=“transaction\_date”,metric=“cardinality:customer\_name”,offset ="-1M"))
thank you for your reply
i tryed it but the same error appear
SyntaxError: {"type":"incompleteFunction","function":"es","location":{"min":101,"max":104},"text":".es"}
at peg$buildException (eval at compile (/opt/kibana-5.5.0-linux-x86\_64/node\_modules/pegjs/lib/compiler.js:54:37), :363:14)
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [August 17, 2017, 2:33pm UTC](https://discuss.elastic.co/t/timelion-of-kibana-error-incomplete-function/97230/4 "2017-08-17T14:33:45Z")
I think between copy/pasting in this thread a bunch of the single quotes have been replaced with double-quotes and smart-quotes. When you're trying it I think you should be using single quotes everywhere. Let me know if that fixes it.
With my data I was able to use this expression;
`.es(index='metricbeat-*',metric='cardinality:metricset.name').subtract(.es(index='metricbeat-*',metric='cardinality:metricset.name',offset ='-9m'))`
Another thought is to break down you expression so that you can test each part. For example, the `.es()` block inside the `.subtract()` does that work by itself?
---
### Author:  [@marwa](https://discuss.elastic.co/u/marwa)
#### Post date: [August 18, 2017, 10:47pm UTC](https://discuss.elastic.co/t/timelion-of-kibana-error-incomplete-function/97230/5 "2017-08-18T22:47:33Z")
thank you for your reply
it worked but i didn't understand why timelion series of kibana always give me null results or nothing at all even if there is no error and when i add .points() function it only gives one point
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 15, 2017, 10:47pm UTC](https://discuss.elastic.co/t/timelion-of-kibana-error-incomplete-function/97230/6 "2017-09-15T22:47:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.