Instead of using a visual editor to create charts, you define a graph by chaining functions together, using the *Timelion*-specific syntax.
The syntax enables some features that classical point series charts don't offer, such as pulling data from different indices or data sources into one graph.
deprecated::[7.0.0,"*Timelion* is still supported. The *Timelion app* is deprecated in 7.0, replaced by dashboard features. In 8.0 and later, the *Timelion app* is removed from {kib}. To prepare for the removal of *Timelion app*, you must migrate *Timelion app* worksheets to a dashboard. For information on how to migrate *Timelion app* worksheets, refer to the link:https://www.elastic.co/guide/en/kibana/7.10/release-notes-7.10.0.html#deprecation-v7.10.0[7.10.0 Release Notes]."]
Timelion functions always start with a dot, followed by the function name, followed by parentheses containing all the parameters to the function.
The `.es` (or `.elasticsearch` if you are a fan of typing long words) function gathers data from {es} and draws it over time. By default the .es function will just count the number of documents, resulting in a graph showing the amount of documents over time.
[float]
==== Function parameters
Functions can have multiple parameters, and so does the `.es` function. Each parameter has a name, that you can use inside the parentheses to set its value. The parameters also have an order, which is shown by the autocompletion or the documentation (using the Docs button in the top menu).
If you don't specify the parameter name, timelion assigns the values to the parameters in the order, they are listed in the documentation.
The fist parameter of the .es function is the parameter q (for query), which is a Query String used to filter the data for this series. You can also explicitly reference this parameter by its name, and I would always recommend doing so as soon as you are passing more than one parameter to the function. The following two expressions are thus equivalent:
.es(*)
.es(q=*)
Multiple parameters are separated by comma. The .es function has another parameter called index, that can be used to specify an index pattern for this series, so the query won't be executed again all indexes (or whatever you changed the above mentioned setting to).
.es(q=*, index=logstash-*)
If the value of your parameter contains spaces or commas you have to put the value in single or double quotes. You can omit these quotes otherwise.
{kib} supports many y-axis scales and ranges for your data series.
The `.yaxis()` function supports the following parameters:
* *yaxis* — The numbered y-axis to plot the series on. For example, use `.yaxis(2)` to display a second y-axis.
* *min* — The minimum value for the y-axis range.
* *max* — The maximum value for the y-axis range.
* *position* — The location of the units. Values include `left` or `right`.
* *label* — The label for the axis.
* *color* — The color of the axis label.
* *units* — The function to use for formatting the y-axis labels. Values include `bits`, `bits/s`, `bytes`, `bytes/s`, `currency(:ISO 4217 currency code)`, `percent`, and `custom(:prefix:suffix)`.
* *tickDecimals* — The tick decimal precision.
Example:
[source,text]
----------------------------------
.es(index= kibana_sample_data_logs,
timefield='@timestamp',
metric='avg:bytes')
.label('Average Bytes for request')
.title('Memory consumption over time in bytes').yaxis(1,units=bytes,position=left), <1>
==== Tutorial: Create visualizations with Timelion
You collected data from your operating system using Metricbeat, and you want to visualize and analyze the data on a dashboard. To create panels of the data, use *Timelion* to
create a time series visualization,
[float]
===== Add the data and create the dashboard
Set up Metricbeat, then create the dashboard.
. To set up Metricbeat, go to {metricbeat-ref}/metricbeat-installation-configuration.html[Metricbeat quick start: installation and configuration]
. From {kib}, open the main menu, then click *Dashboard*.
. On the *Dashboards* page, click *Create dashboard*.
[float]
===== Open and set up Timelion
Open *Timelion* and change the time range.
. On the dashboard, click *Create panel*.
. On the *New visualization* window, click *Aggregation based > Timelion*.
. Change the <<set-time-filter,time range>> to *Last 7 days*.
=== Detect outliers and discover patterns over time
To easily detect outliers and discover patterns over time, modify the time series data with conditional logic and create a trend with a moving average.
With Timelion conditional logic, you can use the following operator values to compare your data:
[horizontal]
`eq`:: equal
`ne`:: not equal
`lt`:: less than
`lte`:: less than or equal to
`gt`:: greater than
`gte`:: greater than or equal to
[float]
[[conditional-define-functions]]
==== Define the functions
To chart the maximum value of `system.memory.actual.used.bytes`, enter the following in the *Timelion Expression* field, then click *Update*:
[source,text]
----------------------------------
.es(index=metricbeat-*,
timefield='@timestamp',
metric='max:system.memory.actual.used.bytes')
----------------------------------
[float]
[[conditional-track-memory]]
==== Track used memory
To track the amount of memory used, create two thresholds, then click *Update*:
[source,text]
----------------------------------
.es(index=metricbeat-*,
timefield='@timestamp',
metric='max:system.memory.actual.used.bytes'),
.es(index=metricbeat-*,
timefield='@timestamp',
metric='max:system.memory.actual.used.bytes')
.if(gt, <1>
11300000000, <2>
.es(index=metricbeat-*,
timefield='@timestamp',
metric='max:system.memory.actual.used.bytes'),
null)
.label('warning')
.color('#FFCC11'),
.es(index=metricbeat-*,
timefield='@timestamp',
metric='max:system.memory.actual.used.bytes')
.if(gt,
11375000000,
.es(index=metricbeat-*,
timefield='@timestamp',
metric='max:system.memory.actual.used.bytes'),
null)
.label('severe')
.color('red')
----------------------------------
<1> `if()` compares each point to a number. When the condition is `true`, adjust the styling. When the condition is `false`, use the default styling.
<2> *Timelion* conditional logic for the _greater than_ operator. In this example, the warning threshold is 11.3GB (`11300000000`),
and the severe threshold is 11.375GB (`11375000000`). If the threshold values are too high or low for your machine, adjust the values.
[float]
[[conditional-determine-trend]]
==== Determine the trend
To determine the trend, create a new data series, then click *Update*:
[source,text]
----------------------------------
.es(index=metricbeat-*,
timefield='@timestamp',
metric='max:system.memory.actual.used.bytes'),
.es(index=metricbeat-*,
timefield='@timestamp',
metric='max:system.memory.actual.used.bytes')
.if(gt,11300000000,
.es(index=metricbeat-*,
timefield='@timestamp',
metric='max:system.memory.actual.used.bytes'),
null)
.label('warning')
.color('#FFCC11'),
.es(index=metricbeat-*,
timefield='@timestamp',
metric='max:system.memory.actual.used.bytes')
.if(gt,11375000000,
.es(index=metricbeat-*,
timefield='@timestamp',
metric='max:system.memory.actual.used.bytes'),
null).
label('severe')
.color('red'),
.es(index=metricbeat-*,
timefield='@timestamp',
metric='max:system.memory.actual.used.bytes')
.mvavg(10) <1>
----------------------------------
<1> `mvavg()` calculates the moving average over a specified period of time.
In this example, `.mvavg(10)` creates a moving average with a window of 10 data points.
[float]
[[conditional-format-visualization]]
==== Customize and format the visualization
Customize and format the visualization using the following functions, then click *Update*:
[source,text]
----------------------------------
.es(index=metricbeat-*,
timefield='@timestamp',
metric='max:system.memory.actual.used.bytes')
.label('max memory') <1>
.title('Memory consumption over time'), <2>
.es(index=metricbeat-*,
timefield='@timestamp',
metric='max:system.memory.actual.used.bytes')
.if(gt,
11300000000,
.es(index=metricbeat-*,
timefield='@timestamp',
metric='max:system.memory.actual.used.bytes'),
null)
.label('warning')
.color('#FFCC11') <3>
.lines(width=5), <4>
.es(index=metricbeat-*,
timefield='@timestamp',
metric='max:system.memory.actual.used.bytes')
.if(gt,
11375000000,
.es(index=metricbeat-*,
timefield='@timestamp',
metric='max:system.memory.actual.used.bytes'),
null)
.label('severe')
.color('red')
.lines(width=5),
.es(index=metricbeat-*,
timefield='@timestamp',
metric='max:system.memory.actual.used.bytes')
.mvavg(10)
.label('mvavg')
.lines(width=2)
.color(#5E5E5E)
.legend(columns=4, position=nw) <5>
----------------------------------
[role="screenshot"]
image::images/timelion-conditional04.png[Final visualization that displays outliers and patterns over time]
{nbsp}
[float]
==== Save the panel
Save and add the panel to the dashboard.
. From the toolbar, click *Save*.
. Enter the *Title* and optional *Description*.
. From the *Tags* drop down, select any applicable tags.
. Select *Add to Dashboard after saving*.
. Click *Save and return*.
For more information about *Timelion* conditions, refer to https://www.elastic.co/blog/timeseries-if-then-else-with-timelion[I have but one .condition()].