TImelion serie per field value

Elastic Stack Kibana
1

I can't seem to find a way to create multiple series in Timelion based on the values of a field in the data set. For example, I have interface data from collectd in logstash and want to split it per host. I get the right chart for our whole infrastructure by doing this:

.es(q="collectd AND collectd_type: if_octets", metric=avg:rx).derivative().divide(1048576)

But how do I now get a line per host?

2

You might be looking for Terms agg support in Timelion? If so, feel free to weigh in on this enhancement request: https://github.com/elastic/timelion/issues/15

3

That's it, thanks!