Hi Rashid,
Thanks for the explanations.
I have the same exact problem and I think, both solutions does not solve the issue.
I am trying to illustrate netflow data in ES and Kibana.
I have a field which is called IN_BYTES (input bytes) and I have used four different methods t visualize it, but still there is problem. I have attached a screenshot to help :
The left top figure is generated using Visual Builder,
The left bottom figure is generated in Timelion using:
.es(metric='sum:IN_BYTES').multiply(8).divide(1048576).mvavg(1s).color(#0FFFF0).lines(width=1,fill=2).label('Input').title('Traffic [Mbps]')
The top right figure is generated in Timelion using:
.es(index=nprobe*, timefield=@timestamp, metric=sum:IN_BYTES).cusum().derivative().mvavg(5).multiply(8).divide(1048576).lines(fill=2,width=1).color(#00FF00).label("Input").title("Traffic [Mbps]")
The right bottom figure is created in Timelion using:
.es(metric='sum:IN_BYTES').multiply(8).divide(1048576).scale_interval(1s).fit(scale).lines(width=2,fill=1).color(#00FF00).label('input').title('Traffic [Mbps]')
As you can see there is no consistency between Y-axis values, while the scale-fitted figure shows correct values (right-bottom) according to interface.
Then problem rises when I zoom in, for instance to 6 minutes of data. As you can see in the below image:
The values goes several times up which is not reasonable at all, if interface speed has been less than 200 Mbps as seen in the selected area:
It cannot be more than 1000 Mbps in the same period as seen:
I appreciate if you could help me.
Cheers,
Siamak