# Timelion visualization - getting average of events grouped by id

**URL:** <https://discuss.elastic.co/t/timelion-visualization-getting-average-of-events-grouped-by-id/356936>\
**Category:** Kibana\
**Tags:** timelion\
**Created:** [April 8, 2024, 5:13am UTC](https://discuss.elastic.co/t/timelion-visualization-getting-average-of-events-grouped-by-id/356936 "2024-04-08T05:13:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sabika](https://avatars.discourse-cdn.com/v4/letter/s/bbce88/32.png) [@Sabika](https://discuss.elastic.co/u/Sabika)\
**Post date:** [April 8, 2024, 5:13am UTC](https://discuss.elastic.co/t/timelion-visualization-getting-average-of-events-grouped-by-id/356936/1 "2024-04-08T05:13:31Z")

</div>

Hi, I am tryng to calculate average of a group of events by calculating the difference between min and max timestamps and then dividing by count.

1. Split events by an ID
2. For each of these groups calculate time taken(by subtracting min timestamp from max timespamt)
3. Calculate avg for the time taken  
I am using Timelion and splitting the events by an ID. However, I might be doing something wrong because this looks like it is creating multiple buckets. Here is my query:

\<.es(index=filebeat-_,q="_",metric='max:@timestamp',split=context\_id.keyword:10).subtract(.es(index=filebeat-_,q="_",metric='min:@timestamp',split=context\_id.keyword:10)).divide(.es(index=filebeat-_,q="_",metric='count',split=context\_id.keyword:10))/\>

What i am seeing is

 ![Screenshot 2024-04-08 at 10.39.21 AM](https://us1.discourse-cdn.com/elastic/original/3X/5/d/5d210ef296c076c56dfcb850e51b5fc32fff6e5f.png)

What I expect to see is a continous line graph.

Can you please help here? I can use any other visualization as well to get this done, but have been trying in timelion so far.

---

<div class="post-metadata">

**Author:** ![ryan1969](https://avatars.discourse-cdn.com/v4/letter/r/ecae2f/32.png) [@ryan1969](https://discuss.elastic.co/u/ryan1969)\
**Post date:** [April 8, 2024, 6:08am UTC](https://discuss.elastic.co/t/timelion-visualization-getting-average-of-events-grouped-by-id/356936/2 "2024-04-08T06:08:42Z")

</div>

> [@Sabika](#):
>
> What I expect to see is a continous line graph.
> 
> Can you please help here? I can use any other visualization as well to get this done, but have been trying in timelion so far.

Hello,

It seems like you’re on the right track with your Timelion query, but the issue you’re encountering is due to the split function creating separate series for each context\_id. To achieve a continuous line graph representing the average time taken for all events, you’ll need to aggregate the results of your calculations into a single series.

Here’s a revised version of your query that should help you get a continuous line graph:

.es(index=filebeat-_, metric='max:@timestamp', split=context\_id.keyword:10)  
.subtract(.es(index=filebeat-_, metric='min:@timestamp', split=context\_id.keyword:10))  
.divide(.es(index=filebeat-\*, metric='count', split=context\_id.keyword:10))  
.aggregate('avg')

This query will calculate the max and min timestamps for each context\_id, subtract them to get the duration, divide by the count to get the average, and then use the .aggregate('avg') function to average these values across all context\_id buckets.

Make sure to replace filebeat-\* with the actual index pattern you’re using if it’s different. Also, adjust the split parameter if you need to analyze more or fewer context\_id buckets.

I hope my suggestion is helpful for you.

---

<div class="post-metadata">

**Author:** ![Sabika](https://avatars.discourse-cdn.com/v4/letter/s/bbce88/32.png) [@Sabika](https://discuss.elastic.co/u/Sabika)\
**Post date:** [April 8, 2024, 7:49am UTC](https://discuss.elastic.co/t/timelion-visualization-getting-average-of-events-grouped-by-id/356936/3 "2024-04-08T07:49:04Z")

</div>

Hello Ryan, Thanks for your assistance here. There is still a problem in that I still see multiple lines - one for each context id.

 ![Screenshot 2024-04-08 at 1.17.57 PM](https://us1.discourse-cdn.com/elastic/original/3X/5/1/513b5dae30f548650184bdcfea62502a716c1d61.png)  
What I want to achieve is a single line which will show the average time for all the context ids.