# Bandwidth by accumulated data?

**URL:** <https://discuss.elastic.co/t/bandwidth-by-accumulated-data/119811>\
**Category:** Kibana\
**Created:** [February 14, 2018, 2:05pm UTC](https://discuss.elastic.co/t/bandwidth-by-accumulated-data/119811 "2018-02-14T14:05:08Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![skydiablo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skydiablo/32/26527_2.png) [@skydiablo](https://discuss.elastic.co/u/skydiablo)\
**Post date:** [February 14, 2018, 2:05pm UTC](https://discuss.elastic.co/t/bandwidth-by-accumulated-data/119811/1 "2018-02-14T14:05:08Z")

</div>

Hello,  
I would like to create a line chart of the used bandwidth. I have the data accumulated so far for every minute. How can I create a chart from it?

---

<div class="post-metadata">

**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\
**Post date:** [February 14, 2018, 9:19pm UTC](https://discuss.elastic.co/t/bandwidth-by-accumulated-data/119811/2 "2018-02-14T21:19:36Z")

</div>

Is bandwidth used a numeric field in your documents? If so, something like this:

 ![05%20PM](https://us1.discourse-cdn.com/elastic/original/3X/b/c/bc8b8502187c51fb537e8cf53369c3e7feb04ae4.png)

---

<div class="post-metadata">

**Author:** ![skydiablo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skydiablo/32/26527_2.png) [@skydiablo](https://discuss.elastic.co/u/skydiablo)\
**Post date:** [February 15, 2018, 8:07am UTC](https://discuss.elastic.co/t/bandwidth-by-accumulated-data/119811/3 "2018-02-15T08:07:46Z")

</div>

Okay, first of all, all the details:  
I have about 30 access points and their already transmitted data since start in one value (individually for each AP). This data is collected every minute. so I have an absolute value that grows almost every minute. Now I would like to show a bandwidth usage in a chart over all APs (later also for certain groups).  
Currently I have this result: (

 ![2018-02-15%2009_05_53-Kibana](https://us1.discourse-cdn.com/elastic/original/3X/a/9/a940f56bed1afecf7f8d548e6a8cfbefcb5413d3.png)

---

<div class="post-metadata">

**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\
**Post date:** [February 15, 2018, 3:42pm UTC](https://discuss.elastic.co/t/bandwidth-by-accumulated-data/119811/4 "2018-02-15T15:42:15Z")

</div>

So is that the field you expect to be growing? If you look at that field in the individual docs in Discover, does that seem to be the case?

---

<div class="post-metadata">

**Author:** ![skydiablo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skydiablo/32/26527_2.png) [@skydiablo](https://discuss.elastic.co/u/skydiablo)\
**Post date:** [February 16, 2018, 1:03pm UTC](https://discuss.elastic.co/t/bandwidth-by-accumulated-data/119811/5 "2018-02-16T13:03:31Z")

</div>

here an example of an AccessPoint.

 ![2018-02-16%2014_00_09-Discover%20-%20Kibana](https://us1.discourse-cdn.com/elastic/original/3X/8/f/8f2fb68ff24de128185ac76d4efc4f4dd0910b07.png)

---

<div class="post-metadata">

**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\
**Post date:** [February 16, 2018, 4:31pm UTC](https://discuss.elastic.co/t/bandwidth-by-accumulated-data/119811/6 "2018-02-16T16:31:05Z")

</div>

It looks like the size of the values may be washing out the relatively small changes from one doc to the next in your line chart. You could try enabling `Scale to Data Bounds` in the "Metrics & Axes" tab of the visualization editor:

 ![43%20AM](https://us1.discourse-cdn.com/elastic/original/3X/6/f/6f76c5c6c8f8b32ed64e36a7bc93d07855ba79fd.png)

---

<div class="post-metadata">

**Author:** ![skydiablo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skydiablo/32/26527_2.png) [@skydiablo](https://discuss.elastic.co/u/skydiablo)\
**Post date:** [February 19, 2018, 7:56am UTC](https://discuss.elastic.co/t/bandwidth-by-accumulated-data/119811/7 "2018-02-19T07:56:17Z")

</div>

ok, now the formatting is a bit more chic, but that doesn't solve my real problem. As you can see now, the value just keeps increasing. And now I want to have the resulting bandwidth as a chart.

 ![2018-02-19%2008_42_29-](https://us1.discourse-cdn.com/elastic/original/3X/8/f/8f8ce32d813c7704f220682b0fe791d37541954b.png)

---

<div class="post-metadata">

**Author:** ![skydiablo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skydiablo/32/26527_2.png) [@skydiablo](https://discuss.elastic.co/u/skydiablo)\
**Post date:** [February 20, 2018, 1:50pm UTC](https://discuss.elastic.co/t/bandwidth-by-accumulated-data/119811/8 "2018-02-20T13:50:30Z")

</div>

My current expression:

> .es(index="ruckus\_ap\_info", metric="max:ruckusSZAPTXBytes", split="ruckusSZAPMac:10", kibana=true).derivative().divide(1024).scale\_interval(1s).if(operator="lt", if=0, then=0).trim(start=2,end=1).label(regex="^.\* ruckusSZAPMac:(.+) \> .\*$", label="$1").lines(width=1).yaxis(label="KB / sec", min=0)

this ends in this chart:

 ![2018-02-20%2014_41_44-Ruckus%20APs%20Bandwidth%20-%20Kibana](https://us1.discourse-cdn.com/elastic/original/3X/a/c/acbcf7f93368dff543c6cdf267a4a4b90bb81f24.png)

Now I have three questions to ask:

1. are these numbers in the chart correct?
2. how can I connect this jump with each other without the chart always returning to zero?
3. the label is very unattractive, here I would like to point to another field (ruckusSZAPName), is that possible?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 20, 2018, 1:50pm UTC](https://discuss.elastic.co/t/bandwidth-by-accumulated-data/119811/9 "2018-03-20T13:50:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
