Timelion / Time Series - Limit result

[Kornelia_Watson]

Hi.

I have two index patterns: pattern A which is time based, and pattern B, which is not.

Pattern A has an order type, which, as you can guess stores data related to customer orders (date, ID, shipping latency etc). Pattern B stores customer account data amongst which is a date when a specific event happened (they started using automation to process orders).

What I need to do is to create a timeline that shows an average shipping latency but also puts a mark of some sort on a date when a customer started using automation so that an impact of processing orders through it can be seen.

Because pattern B is not time based I don't think it is possible for me to plot it on the same visualisation. I might be wrong though?

Other approach I tried was to

1. plot average shipping latency
2. plot (minimum) order IDs of orders that were processed through the automation.

.es(index=pattern_a-*, q='_type:order', metric=avg:shipping_latency), .es(index=pattern_b, q='_type:order AND is_processed_by_automation:true', metric=min:id)

That nearly does it but is there a way to limit the result of the second query so that I only plot 1 point?

Or is there a better way to achieve what I need?

Thank you

[Bargs (Matt Bargar)]

I might not fully understand the question, but you can plot pattern A and B on the same Timelion visualization as long as pattern B has a date field, even if it is not selected at the time field for the pattern. The .es() function has a timefield argument which you can use to override the default timefield. So you could do something like:

.es(index=pattern_b, timefield=eventDate, q="eventName:automation-started")

Does that help? Or am I still missing a piece of the puzzle?

[Kornelia_Watson]

Excellent! That did exactly what I was looking for. Thank you so much for your help.