Learning Elastic Stack 6.0

Timelion expressions

The simplest Timelion expression used for generating graphs is as follows:

.es(*) 

Timelion expressions always start with a dot followed by the function name which can accept one or more parameters. The .es(*) expression queries data from all the indexes present in Elasticsearch. By default, it will just count the number of documents, resulting in a graph showing the number of documents over time.

If you'd like to restrict Timelion to data within a specific index (for example, logstash-*) , you can specify the index within the function as follows: 

.es(index=logstash-*) 

As Timelion is a time-series visualizer, it uses the @timestamp field present in the index as the time field for plotting the values on an x axis. One ...