Closed loekvangool closed 8 years ago
It seems that dots are not allowed in the name of an index:
Query: .es(index=.watch_history-2016.06.29, timefield=result.execution_time, q="watch_id:cef-IDS-Failures AND result.condition.met:true").points(radius=7, fill=10, symbol=cross, weight=2.5).multiply(50).condition(operator=lte, if=0).label("Triggered alerts")
.es(index=.watch_history-2016.06.29, timefield=result.execution_time, q="watch_id:cef-IDS-Failures AND result.condition.met:true").points(radius=7, fill=10, symbol=cross, weight=2.5).multiply(50).condition(operator=lte, if=0).label("Triggered alerts")
Error: Timelion: SyntaxError: {"type":"incompleteFunction","function":"watch_history-2016","location":{"min":306,"max":325},"text":".watch_history-2016"}
Timelion: SyntaxError: {"type":"incompleteFunction","function":"watch_history-2016","location":{"min":306,"max":325},"text":".watch_history-2016"}
Fixed by adding quotes like this: es(index=".watch_history-*"
es(index=".watch_history-*"
It seems that dots are not allowed in the name of an index:
Query:
.es(index=.watch_history-2016.06.29, timefield=result.execution_time, q="watch_id:cef-IDS-Failures AND result.condition.met:true").points(radius=7, fill=10, symbol=cross, weight=2.5).multiply(50).condition(operator=lte, if=0).label("Triggered alerts")
Error:
Timelion: SyntaxError: {"type":"incompleteFunction","function":"watch_history-2016","location":{"min":306,"max":325},"text":".watch_history-2016"}