The simplest Timelion expression used for generating graphs is as follows:
.es(*)
Timelion expressions always start with a dot followed by the function name that can accept one or more parameters. The .es(*) expression queries data from all the indexes present in Elasticsearch. By default, it will just count the number of documents, resulting in a graph showing the number of documents over time.
If you'd like to restrict Timelion to data within a specific index (for example, logstash-*), you can specify the index within the function as follows:
.es(index=logstash-*)
As Timelion is a time-series visualizer, it uses the @timestamp field present in the index as the time field for plotting the values on an x axis. You ...
