Search code examples
elasticsearchkibanaelastic-stackkibana-6timelion

Timelion split multiple times

Is there any possibility to split multiple times in timelion?

Currently I use an expression like this:

.es(q='name:*jvm*', metric=avg:mean, split=name.keyword:10)
  .label(regex='.*whatever\.(.*) >.*', label=$1)

resulting in a timeseries diagram.

If I would like to add a second application, I'd just add another expression with an additional AND in the es query and split like this:

.es(q='name:*jvm* AND app:one', metric=avg:mean, split=name.keyword:10)
  .label(regex='.*whatever\.(.*) >.*', label='one-$1'),
.es(q='name:*jvm* AND app:two', metric=avg:mean, split=name.keyword:10)
  .label(regex='.*whatever\.(.*) >.*', label='two-$1')

Isn't it possible to do this in a single expression?

Solution

  • you can apply split multiple times inside .es().

    Try this:

    .es(q='name:*jvm*', metric=avg:mean, split=app.keyword:10, split=name.keyword:10)
  .label(regex='.*whatever\.(.*) >.*', label='$1-$2')