# Timelion
**URL:** https://discuss.elastic.co/t/timelion/241889
**Category:** Kibana
**Tags:** timelion
**Created:** [July 20, 2020, 12:31pm UTC](https://discuss.elastic.co/t/timelion/241889 "2020-07-20T12:31:30Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@g\_k\_b](https://discuss.elastic.co/u/g_k_b)
#### Post date: [July 20, 2020, 12:31pm UTC](https://discuss.elastic.co/t/timelion/241889/1 "2020-07-20T12:31:30Z")
Hi everyone,
I'm using Timelion and wht I would love to do now is setting a different color for data with timestamp from 9pm to 7am.
How can I write the query?
I read about the syntax FROM...TO but the examples I found are with date; I want to select a time range, not a date range. My query should be valid everyday.
Thank you in advance for your help 🙂
---
### Author:  [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)
#### Post date: [July 20, 2020, 10:10pm UTC](https://discuss.elastic.co/t/timelion/241889/2 "2020-07-20T22:10:14Z")
I don't believe that is a feature, but you should be able to get the same approach by stacking, similar to what was outline under "conditional selection" in [https://www.elastic.co/blog/timelion-tutorial-from-zero-to-hero](https://www.elastic.co/blog/timelion-tutorial-from-zero-to-hero).
The idea is, draw one line with a color - then draw a second line with another color, but exclude data between 9pm and 7am.
---
### Author:  [@g\_k\_b](https://discuss.elastic.co/u/g_k_b)
#### Post date: [July 22, 2020, 7:58am UTC](https://discuss.elastic.co/t/timelion/241889/3 "2020-07-22T07:58:59Z")
Thank you @tylersmalley for the reply!
My "problem" is that I want to filter on @timestamp field, and there is nothing about it in the article you linked. I've tried the syntax _FROM [21:00:00] TO [07:00:00]_ but it didn't work; plus, I can't add the day because I need to set this condition for every date I select from the proper tool on the top right in Kibana.
---
### Author:  [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)
#### Post date: [July 23, 2020, 4:30pm UTC](https://discuss.elastic.co/t/timelion/241889/4 "2020-07-23T16:30:37Z")
My bad, you're right. Tim wrote about this in the past here: [Kibana Filter for a specific time range](https://discuss.elastic.co/t/kibana-filter-for-a-specific-time-range/105169/2)
You would have to extract that into something that is filterable, like a boolean field "is\_working\_hours". You could use a scripted field, but that wouldn't be very performant.
---
### Author:  [@g\_k\_b](https://discuss.elastic.co/u/g_k_b)
#### Post date: [July 24, 2020, 7:07am UTC](https://discuss.elastic.co/t/timelion/241889/5 "2020-07-24T07:07:39Z")
Thank you Tyler, that's exactly what I was looking for!
Could you explain me why scripted fields are less performant that a new field created before the ingestion?
Thank you in advance!
---
### Author:  [@flash1293](https://discuss.elastic.co/u/flash1293)
#### Post date: [July 24, 2020, 7:58am UTC](https://discuss.elastic.co/t/timelion/241889/6 "2020-07-24T07:58:23Z")
Scripted fields are sent to Elasticsearch and calculated on request - this means to determine whether a document should be included in the response or not, Elasticsearch has to run the script for each document in the matching time range - and again for each new request.
When a field is created before ingestion, Elasticsearch can create an [inverted index](https://www.elastic.co/blog/found-elasticsearch-from-the-bottom-up#inverted-indexes-and-index-terms) which speeds up the decision whether to include a document significantly.
Scripted fields are handy and if you are working with small data sets they can be totally fine, but it's important to know it's likely to hit performance limits quickly when scaling up the data - a classical trade-off between performance and flexibility.
It's recommended to use scripted fields for prototyping if you don't know yet how you will query your data - once you know, you can "productionize" and move the calculation to ingest time.
---
### Author:  [@g\_k\_b](https://discuss.elastic.co/u/g_k_b)
#### Post date: [July 24, 2020, 8:03am UTC](https://discuss.elastic.co/t/timelion/241889/7 "2020-07-24T08:03:15Z")
Thank you very much for your exhaustive reply! It's extremely useful and clear 😃
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 21, 2020, 8:03am UTC](https://discuss.elastic.co/t/timelion/241889/8 "2020-08-21T08:03:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.