# Timelion querying bytes\_in over pool

**URL:** <https://discuss.elastic.co/t/timelion-querying-bytes-in-over-pool/122477>\
**Category:** Kibana\
**Created:** [March 5, 2018, 10:28am UTC](https://discuss.elastic.co/t/timelion-querying-bytes-in-over-pool/122477 "2018-03-05T10:28:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![OucemaBellagha](https://avatars.discourse-cdn.com/v4/letter/o/5fc32e/32.png) [@OucemaBellagha](https://discuss.elastic.co/u/OucemaBellagha)\
**Post date:** [March 5, 2018, 10:28am UTC](https://discuss.elastic.co/t/timelion-querying-bytes-in-over-pool/122477/1 "2018-03-05T10:28:18Z")

</div>

I want to have visualization showing bytes\_in sorted by pools, here's expl of data:

> ```
> beat.name x.x.x.x
> beat.version 5.6.8
> bytes_in 202091918
> bytes_out 8688067381
> hadrware.visibility private
> hardware.subtype loadbalancer
> hardware.type networking
> host xxxxx
> pool poolA
> input_type log
> loadbalancer x.x.x.x
> timestamp 2018-03-05 10:50:01
> 
> ```

So every 1 min I have multiple pools having bytes\_in, and I wanna get them sorted with timeleon, tried this `.es(metric=pool:*,metric=bytes_in:*)` but it's not working.

---

<div class="post-metadata">

**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\
**Post date:** [March 5, 2018, 10:52am UTC](https://discuss.elastic.co/t/timelion-querying-bytes-in-over-pool/122477/2 "2018-03-05T10:52:15Z")

</div>

You will probably want to start with something like this...

```auto
.es(index="INDEXNAME", metric="sum:bytes_in", split="pools:10", kibana=true)

```

Odds are you will want to do more with the chart. Here is an example of one of the charts in our solution...

```auto
.es(index="elastiflow-*", metric="sum:flow.bytes", split="flow.client_hostname:10", kibana=true).multiply(8).scale_interval(1s).fit(mode=scale).if(operator="lt", if=0, then=0).trim(start=1,end=1).label(regex="^.* flow.client_hostname:(.+) > .*$", label="$1").lines(width=1, stack=true, fill=1).yaxis(label="bits / sec", units="bits/s", min=0)

```

To make it more readable...

```auto
.es(
    index="elastiflow-*",
    metric="sum:flow.bytes",
    split="flow.client_hostname:10",
    kibana=true
)
.multiply(8)
.scale_interval(1s)
.fit(mode=scale)
.if(
    operator="lt",
    if=0,
    then=0
)
.trim(
    start=1,
    end=1
)
.label(
    regex="^.* flow.client_hostname:(.+) > .*$",
    label="$1"
)
.lines(
    width=1,
    stack=true,
    fill=1
)
.yaxis(
    label="bits / sec",
    units="bits/s",
    min=0
)

```

The result looks like this...

 ![58](https://us1.discourse-cdn.com/elastic/original/3X/e/1/e14ff52672643695e1d920ccd5e036633f9ff5dd.png)

---

<div class="post-metadata">

**Author:** ![OucemaBellagha](https://avatars.discourse-cdn.com/v4/letter/o/5fc32e/32.png) [@OucemaBellagha](https://discuss.elastic.co/u/OucemaBellagha)\
**Post date:** [March 5, 2018, 11:58am UTC](https://discuss.elastic.co/t/timelion-querying-bytes-in-over-pool/122477/3 "2018-03-05T11:58:03Z")

</div>

Hi @rcowart, thx for the feedback and indeed I think this could help me a lot but after querying I get following Fata Error:

> ```
> Error: Uncaught TypeError: Cannot read property 'from' of undefined (https://x.x.x.x:x.x.x.x/bundles/commons.bundle.js?v=15523:94)
> at window.onerror (https://x.x.x.x:x.x.x.x/bundles/commons.bundle.js?v=15523:90:22028)
> 
> ```

Seems to be a Kibana problem.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 2, 2018, 11:58am UTC](https://discuss.elastic.co/t/timelion-querying-bytes-in-over-pool/122477/4 "2018-04-02T11:58:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.