# Timelion query spaces

**URL:** <https://discuss.elastic.co/t/timelion-query-spaces/126221>\
**Category:** Kibana\
**Tags:** timelion\
**Created:** [March 30, 2018, 11:13am UTC](https://discuss.elastic.co/t/timelion-query-spaces/126221 "2018-03-30T11:13:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ConorTier](https://avatars.discourse-cdn.com/v4/letter/c/6de8d8/32.png) [@ConorTier](https://discuss.elastic.co/u/ConorTier)\
**Post date:** [March 30, 2018, 11:13am UTC](https://discuss.elastic.co/t/timelion-query-spaces/126221/1 "2018-03-30T11:13:31Z")

</div>

Like the query asked here

> [@Timelion wildcard query](https://discuss.elastic.co/t/timelion-wildcard-query/110694):
>
> Hi there I have a stack of data, each of the documents has a name and a description. A name could look like this: 'Runtimeerror [-191]'. But the number isn't allways the same (Range from -1 to -100'000). I know that I can query them with a wildcard like: GET /\_search { "query": { "wildcard" : { "Title" : "Runtimeerror \*" } } } Is it possible to do a query like the one above but with timelion? The data also contains a timestamp. I have something in mind like this: .es(index=\*, q='Titl…

Is there a way to get Timelion querys to accept spaces, I understand the query is a lucene query

The query I have in question is (which works perfectly well):

logger: SomeLogger+Monitoring AND message:"something happened when"

The Timelion expression I have is:

.es(index=indexName\*,timefield=@timestamp,q=logger:SomeLogger+Monitoring AND message:"something happened when").lines(fill=2, width=3).color(red).label("Monitoring Events")

The below does not work either:

.es(index=indexName\*,timefield=@timestamp,q=logger:SomeLogger+Monitoring AND message:something happened when).lines(fill=2, width=3).color(red).label("Monitoring Events")

Exception = Timelion: SyntaxError: {"type":"incompleteFunction","function":"es","location":{"min":0,"max":3},"text":".es"}

---

<div class="post-metadata">

**Author:** ![ConorTier](https://avatars.discourse-cdn.com/v4/letter/c/6de8d8/32.png) [@ConorTier](https://discuss.elastic.co/u/ConorTier)\
**Post date:** [March 30, 2018, 11:34am UTC](https://discuss.elastic.co/t/timelion-query-spaces/126221/2 "2018-03-30T11:34:25Z")

</div>

q=logger:SomeLogger+Monitoring\ AND\ message:something\ happened\ when

Will not work either

---

<div class="post-metadata">

**Author:** ![ConorTier](https://avatars.discourse-cdn.com/v4/letter/c/6de8d8/32.png) [@ConorTier](https://discuss.elastic.co/u/ConorTier)\
**Post date:** [April 3, 2018, 7:41am UTC](https://discuss.elastic.co/t/timelion-query-spaces/126221/3 "2018-04-03T07:41:33Z")

</div>

As per

> [@Timelion query](https://discuss.elastic.co/t/timelion-query/107050/2):
>
> Try using either quotes, or if you have a non-analyzed field with the same data, you can point to that. Elasticsearch might have created one for you automatically depending on how you set up your mappings, and what version you are using - you can check this out in the Index patterns page of management: the .keyword one above is the one that won't strip out special characters. So here are a few examples: The query as you wrote it, returns too many matches: Adding quotes r…

Looks like you need q='message:"something happened"'

single quotes with inner quotes

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 1, 2018, 7:41am UTC](https://discuss.elastic.co/t/timelion-query-spaces/126221/4 "2018-05-01T07:41:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.