# Timelion visualization not working after upgrading from ES 7 to 8

**URL:** <https://discuss.elastic.co/t/timelion-visualization-not-working-after-upgrading-from-es-7-to-8/380513>\
**Category:** Kibana\
**Tags:** timelion\
**Created:** [July 28, 2025, 10:33pm UTC](https://discuss.elastic.co/t/timelion-visualization-not-working-after-upgrading-from-es-7-to-8/380513 "2025-07-28T22:33:00Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![oskrdt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oskrdt/32/67457_2.png) [@oskrdt](https://discuss.elastic.co/u/oskrdt)\
**Post date:** [July 28, 2025, 10:33pm UTC](https://discuss.elastic.co/t/timelion-visualization-not-working-after-upgrading-from-es-7-to-8/380513/1 "2025-07-28T22:33:00Z")

</div>

After upgrading my elasticsearch and kibana instance from 7 to 8.18.4 my Timelion visualizations that where previously working are getting the following error:

```auto
Unable to load visualization
Error: [timelion_vis] > Timelion request error: in cell #1: status_exception
	Caused by:
		search_phase_execution_exception: all shards failed

```

Did it something changed for Timelion?

---

<div class="post-metadata">

**Author:** ![Marco\_Liberati](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marco_liberati/32/82953_2.png) [@Marco\_Liberati](https://discuss.elastic.co/u/Marco_Liberati)\
**Post date:** [July 29, 2025, 4:56pm UTC](https://discuss.elastic.co/t/timelion-visualization-not-working-after-upgrading-from-es-7-to-8/380513/2 "2025-07-29T16:56:51Z")

</div>

Hi @oskrdt

that looks like an ES error message.  
Would it be possible to share the Timelion expression?

---

<div class="post-metadata">

**Author:** ![oskrdt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oskrdt/32/67457_2.png) [@oskrdt](https://discuss.elastic.co/u/oskrdt)\
**Post date:** [July 29, 2025, 6:03pm UTC](https://discuss.elastic.co/t/timelion-visualization-not-working-after-upgrading-from-es-7-to-8/380513/3 "2025-07-29T18:03:29Z")

</div>

Here is the timelion expression

```auto
.es(index=ai4i_issues,timefield="Date Created", metric=cardinality:_id).cusum().subtract(.es(index=ai4i_issues,timefield="Date Resolved", metric=cardinality:_id).cusum()).label('Backlog')

```

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [July 30, 2025, 4:37am UTC](https://discuss.elastic.co/t/timelion-visualization-not-working-after-upgrading-from-es-7-to-8/380513/4 "2025-07-30T04:37:40Z")

</div>

Hello @oskrdt

Also as per the below error message could you please check if all is OK with the index **ai4i\_issues**

Error : _Caused by: search\_phase\_execution\_exception: all shards failed_)

```auto
GET _cluster/health => What is the health of the cluster?
GET _cat/indices/ai4i_issues?v => What is the health of this index?
GET /_cat/shards/ai4i_issues?v&h=index,shard,prirep,state,store,ip,node => Are all shards STARTED?

```

Thanks!!

---

<div class="post-metadata">

**Author:** ![oskrdt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oskrdt/32/67457_2.png) [@oskrdt](https://discuss.elastic.co/u/oskrdt)\
**Post date:** [July 30, 2025, 5:48am UTC](https://discuss.elastic.co/t/timelion-visualization-not-working-after-upgrading-from-es-7-to-8/380513/5 "2025-07-30T05:48:49Z")

</div>

Hi @Tortoise  
Here are the responses of the health requests (this is a single node instance):

`GET _cluster/health`

```auto
{
  "cluster_name": "elasticsearch",
  "status": "yellow",
  "timed_out": false,
  "number_of_nodes": 1,
  "number_of_data_nodes": 1,
  "active_primary_shards": 58,
  "active_shards": 58,
  "relocating_shards": 0,
  "initializing_shards": 0,
  "unassigned_shards": 3,
  "unassigned_primary_shards": 0,
  "delayed_unassigned_shards": 0,
  "number_of_pending_tasks": 0,
  "number_of_in_flight_fetch": 0,
  "task_max_waiting_in_queue_millis": 0,
  "active_shards_percent_as_number": 95.08196721311475
}

```

`GET _cat/indices/ai4i_issues?v`

```auto
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size dataset.size
yellow open ai4i_issues ntouE0WBR_iexMTO7Qxaxg 1 1 3499 0 12.1mb 12.1mb 12.1mb

```

`GET /_cat/shards/ai4i_issues?v&h=index,shard,prirep,state,store,ip,node`

```auto
index shard prirep state store ip node
ai4i_issues 0 p STARTED 12.1mb 9.114.203.200 vm-2220
ai4i_issues 0 r UNASSIGNED                      

```

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [July 30, 2025, 5:54am UTC](https://discuss.elastic.co/t/timelion-visualization-not-working-after-upgrading-from-es-7-to-8/380513/6 "2025-07-30T05:54:02Z")

</div>

Thank you @oskrdt for sharing the details.

As this is a single node instance, we can make the replicas = 0 for this index :

```auto
PUT /ai4i_issues/_settings
{
  "index": {
    "number_of_replicas": 0
  }
}

```

After this maybe try to see if the Timelion visualization is working or not?

Thanks!!

---

<div class="post-metadata">

**Author:** ![oskrdt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oskrdt/32/67457_2.png) [@oskrdt](https://discuss.elastic.co/u/oskrdt)\
**Post date:** [July 30, 2025, 6:22am UTC](https://discuss.elastic.co/t/timelion-visualization-not-working-after-upgrading-from-es-7-to-8/380513/7 "2025-07-30T06:22:42Z")

</div>

I just did the change to de index and these are the new health output

`GET _cat/indices/ai4i_issues?v`

```auto
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size dataset.size
green open ai4i_issues ntouE0WBR_iexMTO7Qxaxg 1 0 3499 0 12.1mb 12.1mb 12.1mb

```

`GET /_cat/shards/ai4i_issues?v&h=index,shard,prirep,state,store,ip,node`

```auto
index shard prirep state store ip node
ai4i_issues 0 p STARTED 12.1mb 9.114.203.200 vm-2220

```

It was a nice try, but it seems the error persists.

---

<div class="post-metadata">

**Author:** ![oskrdt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oskrdt/32/67457_2.png) [@oskrdt](https://discuss.elastic.co/u/oskrdt)\
**Post date:** [September 2, 2025, 5:11pm UTC](https://discuss.elastic.co/t/timelion-visualization-not-working-after-upgrading-from-es-7-to-8/380513/8 "2025-09-02T17:11:53Z")

</div>

Is there any other suggestion?

---

<div class="post-metadata">

**Author:** ![oskrdt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oskrdt/32/67457_2.png) [@oskrdt](https://discuss.elastic.co/u/oskrdt)\
**Post date:** [September 2, 2025, 7:14pm UTC](https://discuss.elastic.co/t/timelion-visualization-not-working-after-upgrading-from-es-7-to-8/380513/9 "2025-09-02T19:14:56Z")

</div>

I just found that the problem was due my timelion formula was using `metric=cardinality:_id` which seems to be not allowed anymore.  
By just omitting `metric` parameter, my views are using count metric which seems to work fine for what I’m trying to do.