# Timelion split and then filter on splitted values

**URL:** https://discuss.elastic.co/t/timelion-split-and-then-filter-on-splitted-values/134277
**Category:** Kibana
**Tags:** timelion
**Created:** [June 2, 2018, 12:10am UTC](https://discuss.elastic.co/t/timelion-split-and-then-filter-on-splitted-values/134277 "2018-06-02T00:10:59Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![Faisal\_Karakunnel\_Mo](https://avatars.discourse-cdn.com/v4/letter/f/a8b319/32.png) [@Faisal\_Karakunnel\_Mo](https://discuss.elastic.co/u/Faisal_Karakunnel_Mo)
#### Post date: [June 2, 2018, 12:10am UTC](https://discuss.elastic.co/t/timelion-split-and-then-filter-on-splitted-values/134277/1 "2018-06-02T00:10:59Z")

</div>

Hi,

Is it possible in timelion to filter out few of the split values? for example, see below query  
.es(index = sample-\*, q="version:"v1.6"",split=model:5). This will result in 5 different lines model1, model2, model3, model4 and model5. I am interested only in model2 and model 5. So by limiting the split count wont help me (i think so).

Please let me know if there is any way to do this? Any help is much appreciated

Regards  
Faisal

---

<div class="post-metadata">

### Author: ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)
#### Post date: [June 4, 2018, 9:08pm UTC](https://discuss.elastic.co/t/timelion-split-and-then-filter-on-splitted-values/134277/2 "2018-06-04T21:08:49Z")

</div>

@timroes can we get some help here?

Thanks,  
bhavya

---

<div class="post-metadata">

### Author: ![timroes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timroes/32/19712_2.png) [@timroes](https://discuss.elastic.co/u/timroes)
#### Post date: [June 5, 2018, 7:06am UTC](https://discuss.elastic.co/t/timelion-split-and-then-filter-on-splitted-values/134277/3 "2018-06-05T07:06:18Z")

</div>

Hi Faisal,

you can actually use the `q` (query) parameter in that case, to just filter out all those documents with the undesired model already before splitting or in your case filter FOR those values:

```auto
.es(index = sample-*, q="version:'v1.6' AND model:(model2 OR model5)", split=model:5)

```

Cheers,  
Tim

---

<div class="post-metadata">

### Author: ![Faisal\_Karakunnel\_Mo](https://avatars.discourse-cdn.com/v4/letter/f/a8b319/32.png) [@Faisal\_Karakunnel\_Mo](https://discuss.elastic.co/u/Faisal_Karakunnel_Mo)
#### Post date: [June 8, 2018, 11:37pm UTC](https://discuss.elastic.co/t/timelion-split-and-then-filter-on-splitted-values/134277/4 "2018-06-08T23:37:58Z")

</div>

Hi,  
Thanks for the reply. After reading the reply i noticed that my question is missed one specific thing, Sorry about that.

This was my original question

> Is it possible in timelion to filter out few of the split values? for example, see below query  
> .es(index = sample-\*, q="version:"v1.6"",split=model:5). This will result in 5 different lines model1, model2, model3, model4 and model5. I am interested only in model2 and model 5. So by limiting the split count wont help me (i think so).

The change in the question is the parameter 'model' comes with values like **model: [model1,model2]** or **model:[model4:model5]**. In other words it comes as a combination. Still i want to see only _model 5_ and _model1_ .

Sorry to mislead earlier.

Regards  
Faisal

---

<div class="post-metadata">

### Author: ![timroes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timroes/32/19712_2.png) [@timroes](https://discuss.elastic.co/u/timroes)
#### Post date: [June 9, 2018, 10:53am UTC](https://discuss.elastic.co/t/timelion-split-and-then-filter-on-splitted-values/134277/5 "2018-06-09T10:53:21Z")

</div>

Hi,

sorry I missunderstood that. Yeah if you have that kind of array fields within your documents, it's unfortunately not possible to use the query and it's also unfortunately not possible to solve this in Timelion right now. You can nevertheless achieve that in all classical visualizations, since the terms aggregation itself supports filtering out specific buckets (not documents before bucketing) by it's include and exclude setting.

If you create a terms aggregation in a classical chart, you will find an `include` and `exclude` option. In you case you would want to fill the `include` with the value `model2|model5` (it's expected to be a regex).

Cheers,  
Tim

---

<div class="post-metadata">

### Author: ![Faisal\_Karakunnel\_Mo](https://avatars.discourse-cdn.com/v4/letter/f/a8b319/32.png) [@Faisal\_Karakunnel\_Mo](https://discuss.elastic.co/u/Faisal_Karakunnel_Mo)
#### Post date: [June 10, 2018, 9:20pm UTC](https://discuss.elastic.co/t/timelion-split-and-then-filter-on-splitted-values/134277/6 "2018-06-10T21:20:12Z")

</div>

Thank you for the response.

I was specifically looking for availability of include/exclude in Timelion like classical kibana visualization. These days timelion is my best friend answering too many different questions.

Regards  
Faisal

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 8, 2018, 9:20pm UTC](https://discuss.elastic.co/t/timelion-split-and-then-filter-on-splitted-values/134277/7 "2018-07-08T21:20:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
