Timelion sum not working but count does in metric field

[adepuit (Adam DePuit)]

I am somewhat new to Timelion but can't seem to figure out what I am missing that my usage of the sum metric is returning all 0s, when the count seems to work fine.

I have this query:
.es(index=*, timefield='createdTs',metric='count:jobInfo.FWVideo.cpuCount')

Which returns a graph as expected

However I just make a simple change in the metric from count to sum and it only returns 0s.

.es(index=*, timefield='createdTs',metric='sum:jobInfo.FWVideo.cpuCount')

I know there are some null values for jobInfo.FWVideo.cpuCount in my data, but I would assume some graph would appear and the intervals that have only null might default to 0 or some value, but i don't expect 0 to be returned for all ranges that have a mix of null and not null values.

Any ideas to try?

EDIT: Forgot to add, I am on Kibana 5.4

[timroes]

count actually ignores the field value behind it, because it just counts documents. I think the most likely issue here is, that there is a typo in the field name. Are you sure there is a field, written exactly that way (case sensitive) in your index?

[adepuit (Adam DePuit)]

Ah I didn't know count was ignoring everything after the colon, that totally makes sense and I did double check and had a typo.

As a side question to this, I have a field name with a colon in it, and it works for count but wont work for sum. This now makes more sense to me because count ignores field name, but is there a way to escape or handle a field name with a colon in it? Or if I to create a visualization in Timelion on this field I need to change the name to not include a colon?

Are there any other reserved characters i should also avoid if I need to change it?

EDIT: Also querying on these fields with colons in the name works fine in a normal kibana everything else (that I have tried), I am curious why it isn't supported in timelion.

[timroes]

Hi,

unfortunately you currently cannot do this with a colon in the field name, since we use the colon to split away the parameter. I created #22113 to track that issue of supporting field names with colon in there.

I think there are currently two reasonable workaround without you need to rename everything:

1. You can create a scripted field in the index pattern, that just has a different non-colon containing name, that just returns the value of the other field: return doc['otherfield:withcolon].valueas a script. You can now use that new field for metrics, as long as you set theindexparameter for the.es` function in timelion to the exact name that index pattern has.
2. From 6.4.0 onwards, you should be able to add a field alias to your mapping, that does not contain that colon.

Cheers,
Tim

[adepuit (Adam DePuit)]

I tried the scripted field route, and it wasn't working for me so I did some digging and it looks like Timelion doesn't support scripted fields until build 6.1 (https://github.com/elastic/kibana/pull/14700) so for my 5.4 instance it appears there is no workaround.

Thanks for your help, looks like I have to go back to the raw data to see if I can get that modified before indexing.