What is the Timelion query in Kibana to get the trend graph for today's top hit URLs count and the 1 day back data of same URLs for the trend comparison


I am using ElasticSearch, Kibana, Filebeat 7x version. I am trying to create a Timelion query in Kibana to get the today TOP HIT URLs count and 1 day back data of the same URLs for the trend comparison of those graphs. How can we do this?

I've created the below query but it is not showing the today's TOP HIT URLs count data of yesterday, instead It is showing yesterday top hit url data.

.es(index=filebeat- ,timefield=@timestamp,metric=count, split=url.path:5), .es(offset=-1d, index=filebeat- ,timefield=@timestamp,metric=count, split=url.path:5)

I stuck with this issue since long time. Please help me. Thanks in advance.

Hm, unfortunately if you are splitting the data, there isn't really a way in timelion to combine the same splits while still offsetting everything.

It makes more sense if you think about how it works without splits: If you were only looking at one value and comparing it with an offset of -1d, then you would want to see both of those values separately in the legend.

So when you add a split in another query, timelion is still going to separate the values in the legend for you so that each query has a separate legend item... This is even the case if you do the same query twice without an offset: you'll get two entries in the legend.

When you introduce split values, timelion's behavior is still the same: One color-coded item per split item per query. However, since the split values are dynamic and could change from day-to-day, there is no way to guarantee consistency between the two (what's top hit today wasn't necessarily top hit yesterday).

One other thing worth noting -- we do make an attempt to match series like this when using math functions like .divide(). So if you did something like this, timelion attempts to divide and match up each of the series, but returns an error if for some reason series are different:

.es(index="filebeat-*", timefield=@timestamp,metric=count, split=url.path:5),
.es(index="filebeat-*",timefield=@timestamp, metric=count, split=url.path:5).divide(.es(offset=-1d, index="filebeat-*",timefield=@timestamp, metric=count, split=url.path:5))

This is discussed in a bit more detail in this PR: https://github.com/elastic/kibana/pull/14891

If this functionality is something that would be valuable to you, I'd encourage you to open a feature request with a proposal for what you'd like to see!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.