timelion: Sort fields

[danielmotaleite]

Describe the feature:

i'm using this in a timelion:
.es(index=logstash-*, metric=avg:logstash_delay,timefield=logstash_time,split=host:60)

But timelion only sorts the field by number of events and that makes the graph use different colors for each host. Even trying to use .color, it is always swapping colors by reordering and messing the expected output.

The same thing show here:
.es(index=logstash-*,split=error_level:6).color(red:orange:yellow:green:cyan:grey)
it is always sorting the error level and changing the colors. I want the critical to be red, errors, orange, yellow warnings, green info, cyan verbose and grey debug. Even if i change the color order to match what i need, the next page reload will put the colors again wrong.

So the solution to this is to add a extra parameter, the "sort" field, where we can sort by number of events (count, decreasing ) but also sort the bottom (count, increasing), name (name, increasing), max,min, sum, avg, etc

This way, the order will be what we need or at least, be able to change to a constant order (name sort) and allow one to use a custom color layout

[danielmotaleite]

I found this, that may help, specially the .orderby()

https://github.com/rashidkpc/timelion-extras

I hope it will be merged in main kibana

[mdiehm]

+1 I don't understand why the timeseries visual builder has this feature and timelion is lacking it. Would be great to have it! Thanks for your great work in all regards!

[ghudgins]

we are working on two features that I believe will allow you to do this (and many other exciting things)

#101942 - mapping specific colors to specific values across many visualization types. we’re also considering a sort of saved object approach to this palette specification so you don’t have to configure them for every visualization over and over again

#86184 - custom sort order - we are working on adding client side sort control to get at custom sort orders in addition to those you can already do today in the visualization editors.

These fixes aren’t planned for Timelion. Over the years we’ve released many plugins that do many exciting things…but along the way we found ourselves in this “go here for this, there for that” problem that drives many of our users to our repo and discuss forums. Simply put, the proliferation of editors makes it hard for people to accomplish tasks like the one you shared here. While we have no plans to deprecate Timelion we are trying to consolidate visualization functionality into a single editing experience. I know that Timelion offers functionality today unavailable in other places. We are working on advanced text-based inputs in more places in the platform and more things to get at this need. Until we can present that solution to you, Timelion isn’t going anywhere