Timelion queries for 5.3.1 version

Elastic Stack Kibana
1

Hi,
I wanted to know different working example of timelion series.

I am trying to check the unique login by client vs internal user(david,tom) ,Below visualization doesn't work if we change the time-period ( e.g. week to month)- please suggest.

.es(index=logstash-, q='action:login AND topic:Trend AND NOT id:david AND NOT id:tom ').label('Real User logins per Week'), .es(index=logstash-, q='action:login AND topic:Trend').label('All User logins per Week')

I

2

Hi,

When you say the the visualization "doesn't work", what exactly happens? Can you share some before and after screenshots, if possible?

Thanks,

Shaunak

3

Hi Shaunak, thanks for the reply.
Please see the screenshot attached, I have encircled the time window for your reference, please check and let me know if Kibana timelion is showing data correctly.
here problem is when we set the interval as 1w( week) then why it is showing data in 3 days interval, e.g.

Kibana-timelion issue screenshot.png1366×768 103 KB

  1. Indexed data selected is "Last 30 days"
  2. View Option interval is "1w"
  3. X-axis visualization shows the data in 3 days interval i.e 2017-05-02 2017-05-05
  4. If we hover the mouse over the timelion chart, can we see the user name who accessed the app on that particular day, so basically I am trying to explore all these basic points.

Additionally if you can suggest few links having examples of how to configure timelion with different arguments then it would greatly help, as I couldn't find much on internet.

4

The x-axis ticks don't correspond to the bucket intervals. They are there for guidance only. They will span the last 30 days and the ticks (and their corresponding labels: 2017-05-02, 2017-05-05, etc.) will be shown at visually reasonable intervals.

The actual data points on the chart are aggregated values per week. So if you hover over the chart and move your mouse from left to right, you'll notice that the values only change every time you cross a week boundary, not every time you cross a tick on the x-axis.

As for documentation on Timelion, there are a few options:

  1. The original blog post when Timelion was first created: https://www.elastic.co/blog/timelion-timeline. This is more of an introductory blog post.
  2. If you click on the Timelion icon in the left nav, you will be taken to the Timelion app (which is different from creating a Timelion chart in the Visualize app, like you are showing in your screenshots). Then, click on the Help link in the top nav and you will see Timelion's function reference as well as a link to the in-app tutorial.
  3. If you prefer videos, there are a couple of Timelion videos on YouTube as well: https://www.youtube.com/watch?v=-sgZdW5k7eQ, https://www.youtube.com/watch?v=L5LvP_Cj0A0, and https://www.youtube.com/watch?v=cfTehOJScL4 (there may be more; just search for Timelion on YouTube).

Hope that helps,

Shaunak

5

Can you please let me know how to make above visualization presentable, i mean, it is difficult to quickly check no of login in a particular day, since that line which represents no of login doesn't have any dot/pointer which help to identify exact no of login on a particular day, please help me how to modify the query to achieve the requirement

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.