Timelion split and then filter on splitted values

Elastic Stack Kibana
1

Hi,

Is it possible in timelion to filter out few of the split values? for example, see below query
.es(index = sample-*, q="version:"v1.6"",split=model:5). This will result in 5 different lines model1, model2, model3, model4 and model5. I am interested only in model2 and model 5. So by limiting the split count wont help me (i think so).

Please let me know if there is any way to do this? Any help is much appreciated

Regards
Faisal

2

@timroes can we get some help here?

Thanks,
bhavya

3

Hi Faisal,

you can actually use the q (query) parameter in that case, to just filter out all those documents with the undesired model already before splitting or in your case filter FOR those values:

.es(index = sample-*, q="version:'v1.6' AND model:(model2 OR model5)", split=model:5)

Cheers,
Tim

4

Hi,
Thanks for the reply. After reading the reply i noticed that my question is missed one specific thing, Sorry about that.

This was my original question

Is it possible in timelion to filter out few of the split values? for example, see below query
.es(index = sample-*, q="version:"v1.6"",split=model:5). This will result in 5 different lines model1, model2, model3, model4 and model5. I am interested only in model2 and model 5. So by limiting the split count wont help me (i think so).

The change in the question is the parameter 'model' comes with values like model: [model1,model2] or model:[model4:model5]. In other words it comes as a combination. Still i want to see only model 5 and model1 .

Sorry to mislead earlier.

Regards
Faisal

5

Hi,

sorry I missunderstood that. Yeah if you have that kind of array fields within your documents, it's unfortunately not possible to use the query and it's also unfortunately not possible to solve this in Timelion right now. You can nevertheless achieve that in all classical visualizations, since the terms aggregation itself supports filtering out specific buckets (not documents before bucketing) by it's include and exclude setting.

If you create a terms aggregation in a classical chart, you will find an include and exclude option. In you case you would want to fill the include with the value model2|model5 (it's expected to be a regex).

Cheers,
Tim

6

Thank you for the response.

I was specifically looking for availability of include/exclude in Timelion like classical kibana visualization. These days timelion is my best friend answering too many different questions.

Regards
Faisal

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.