# Timelion sum not working but count does in metric field **URL:** \ **Category:** Kibana\ **Tags:** timelion\ **Created:** [August 16, 2018, 4:57pm UTC](https://discuss.elastic.co/t/timelion-sum-not-working-but-count-does-in-metric-field/144758 "2018-08-16T16:57:43Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![adepuit](https://avatars.discourse-cdn.com/v4/letter/a/e68b1a/32.png) [@adepuit](https://discuss.elastic.co/u/adepuit)\ **Post date:** [August 16, 2018, 4:57pm UTC](https://discuss.elastic.co/t/timelion-sum-not-working-but-count-does-in-metric-field/144758/1 "2018-08-16T16:57:43Z")
I am somewhat new to Timelion but can't seem to figure out what I am missing that my usage of the sum metric is returning all 0s, when the count seems to work fine. I have this query: .es(index=\*, timefield='createdTs',metric='count:jobInfo.FWVideo.cpuCount') Which returns a graph as expected ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/4/b4e93b89e5f482b70dcd7ad01b3c1bb7b6c9f82b.png) However I just make a simple change in the metric from count to sum and it only returns 0s. .es(index=\*, timefield='createdTs',metric='sum:jobInfo.FWVideo.cpuCount') ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/f/ef1fccfdedcdc4b471f96861121909cc0baa9ff7.png) I know there are some null values for jobInfo.FWVideo.cpuCount in my data, but I would assume some graph would appear and the intervals that have only null might default to 0 or some value, but i don't expect 0 to be returned for all ranges that have a mix of null and not null values. Any ideas to try? EDIT: Forgot to add, I am on Kibana 5.4 ---
**Author:** ![timroes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timroes/32/19712_2.png) [@timroes](https://discuss.elastic.co/u/timroes)\ **Post date:** [August 16, 2018, 7:05pm UTC](https://discuss.elastic.co/t/timelion-sum-not-working-but-count-does-in-metric-field/144758/2 "2018-08-16T19:05:25Z")
`count` actually ignores the field value behind it, because it just counts documents. I think the most likely issue here is, that there is a typo in the field name. Are you sure there is a field, written exactly that way (case sensitive) in your index? ---
**Author:** ![adepuit](https://avatars.discourse-cdn.com/v4/letter/a/e68b1a/32.png) [@adepuit](https://discuss.elastic.co/u/adepuit)\ **Post date:** [August 16, 2018, 7:10pm UTC](https://discuss.elastic.co/t/timelion-sum-not-working-but-count-does-in-metric-field/144758/3 "2018-08-16T19:10:54Z")
Ah I didn't know count was ignoring everything after the colon, that totally makes sense and I did double check and had a typo. As a side question to this, I have a field name with a colon in it, and it works for count but wont work for sum. This now makes more sense to me because count ignores field name, but is there a way to escape or handle a field name with a colon in it? Or if I to create a visualization in Timelion on this field I need to change the name to not include a colon? Are there any other reserved characters i should also avoid if I need to change it? EDIT: Also querying on these fields with colons in the name works fine in a normal kibana everything else (that I have tried), I am curious why it isn't supported in timelion. ---
**Author:** ![timroes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timroes/32/19712_2.png) [@timroes](https://discuss.elastic.co/u/timroes)\ **Post date:** [August 17, 2018, 6:54am UTC](https://discuss.elastic.co/t/timelion-sum-not-working-but-count-does-in-metric-field/144758/4 "2018-08-17T06:54:50Z")
Hi, unfortunately you currently cannot do this with a colon in the field name, since we use the colon to split away the parameter. I created [#22113](https://github.com/elastic/kibana/issues/22113) to track that issue of supporting field names with colon in there. I think there are currently two reasonable workaround without you need to rename everything: 1. You can create a scripted field in the index pattern, that just has a different non-colon containing name, that just returns the value of the other field: `return doc['otherfield:withcolon`].value`as a script. You can now use that new field for metrics, as long as you set the`index`parameter for the`.es` function in timelion to the exact name that index pattern has. 2. From 6.4.0 onwards, you should be able to add a [field alias](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/alias.html) to your mapping, that does not contain that colon. Cheers, Tim ---
**Author:** ![adepuit](https://avatars.discourse-cdn.com/v4/letter/a/e68b1a/32.png) [@adepuit](https://discuss.elastic.co/u/adepuit)\ **Post date:** [August 17, 2018, 4:11pm UTC](https://discuss.elastic.co/t/timelion-sum-not-working-but-count-does-in-metric-field/144758/5 "2018-08-17T16:11:18Z")
I tried the scripted field route, and it wasn't working for me so I did some digging and it looks like Timelion doesn't support scripted fields until build 6.1 ([https://github.com/elastic/kibana/pull/14700](https://github.com/elastic/kibana/pull/14700)) so for my 5.4 instance it appears there is no workaround. Thanks for your help, looks like I have to go back to the raw data to see if I can get that modified before indexing. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 14, 2018, 4:11pm UTC](https://discuss.elastic.co/t/timelion-sum-not-working-but-count-does-in-metric-field/144758/6 "2018-09-14T16:11:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.