Hi, I'm using Kibana 7.17.0. it seems like the chart area in Kibana disappears when setting timeframe around 5 minutes (2nd screenshot). When I set it slightly longer than that (3rd screenshot), it doesn't seem to show the same data as the one in the first screenshot.
When there is no data, what inspect says?? You may select it on the right of top bar.
Thanks, and you may also view Requests in the Inspector. You can toggle it by View: Data vs View: Request.Does the Response contain the data you want? If not, the Request match the Response?
Yes, they contain the data I want though half of them seem to be null.
Auto interval is 5s for the second figure and 10s for the third figure.
If it is 5s, half of the bucket does not contain any documents. With some assumption, your setting about Missing value (gap policy) is Hide and Not show dots, then no line or dots are rendered because of null values for every two buckets. Set Minimum interval to 10s or Select other Filling method for missing values.
I tried setting Missing values to Linear, Last, and Next but it still doesn't show anything when the timeframe is about 5 minutes. I don't see an option to set Minimum interval though. Could you tell me where it is? Thanks!
Which type of visualization are you using? Lenz or aggregation based?
I'm using Lens.
That did it! Thanks. Although I wish I didn't have to do this.
Actually, there's still the problem of the first screenshot where it shows ~20TB of data but when zoomed in, it becomes the third screenshot which is not anything like the first screenshot. Do you have any idea what could cause that?
I don't know about what type of metric used. If it is sum aggregation, the result is no wonder. Please explain more detail about what you did and what you expects.
Here's the function I used for the metric that shows inconsistent graph.
-1 * differences(average(system.network.in.bytes))
I would expect the graph to show the spike just like when it's zoomed out. Going from several hundred megabytes to twenty terabytes seems like too big of a difference.
When you are using differences formula, values are not calculated around empty buckets regardless of the method for handling missing values.
And are you sure you don't have such outlier by some mistake/error?
Please share the Inspect > request & response for the inconsistent graph. If there are such difference between adjuscent average values, that is not a kibana problem but that of Elasticsearch or data itself.
Okay, I’ll share the data tomorrow when I have access to it again. I think it’s weird that the graph is visualized so differently even though they are showing the same time frame.
Hi Tomo, here's the data. The first one shows the 20TB spike in the graph and second one doesn't.
40-minute timeframe
Top values of host.name,@timestamp per minute,Part of Out,Part of Out,Part of In,Part of In,Part of In,In,Out
test,11:10,20.2TB,,252.5GB,,,,
test,11:11,20.2TB,52.3MB,252.5GB,1.9MB,-1954135.167,-1.86MB,52.33MB
test,11:12,20.2TB,52.5MB,252.5GB,2MB,-2115820.333,-2.02MB,52.46MB
test,11:13,20.2TB,52.2MB,252.5GB,1.9MB,-2038650.667,-1.94MB,52.20MB
test,11:14,20.2TB,52.2MB,252.5GB,2MB,-2102702,-2.01MB,52.22MB
test,11:15,20.2TB,50.4MB,252.5GB,1.8MB,-1910672.833,-1.82MB,50.40MB
test,11:16,20.2TB,51.7MB,252.5GB,1.8MB,-1863604.667,-1.78MB,51.73MB
test,11:17,20.2TB,51.5MB,252.5GB,1.9MB,-1943475,-1.85MB,51.54MB
test,11:18,20.2TB,52.3MB,252.5GB,2.1MB,-2175480.667,-2.07MB,52.26MB
test,11:19,20.2TB,54.1MB,252.5GB,2MB,-2073226.333,-1.98MB,54.05MB
test,11:20,20.2TB,52.5MB,252.5GB,1.9MB,-2025156.333,-1.93MB,52.54MB
test,11:21,20.2TB,51.7MB,252.5GB,1.9MB,-2034859.667,-1.94MB,51.66MB
test,11:22,20.2TB,52.4MB,252.5GB,2MB,-2053941.833,-1.96MB,52.44MB
test,11:23,20.2TB,54MB,252.5GB,2MB,-2075069.333,-1.98MB,54.04MB
test,11:24,20.2TB,53.2MB,252.5GB,1.9MB,-2034837.333,-1.94MB,53.16MB
test,11:25,20.2TB,52.6MB,252.5GB,1.9MB,-2032779.667,-1.94MB,52.62MB
test,11:26,20.2TB,51.6MB,252.5GB,1.9MB,-1986842.5,-1.89MB,51.56MB
test,11:27,20.2TB,49.6MB,252.5GB,1.9MB,-1943997.833,-1.85MB,49.58MB
test,11:28,20.2TB,52.5MB,252.5GB,1.9MB,-1984977.333,-1.89MB,52.54MB
test,11:29,20.2TB,51.4MB,252.5GB,1.9MB,-2011683,-1.92MB,51.44MB
test,11:30,20.2TB,50.9MB,252.5GB,1.9MB,-1990228,-1.90MB,50.87MB
test,11:31,20.2TB,50.6MB,252.5GB,1.9MB,-1961833.167,-1.87MB,50.60MB
test,11:32,20.2TB,51.8MB,252.5GB,1.9MB,-2000728.167,-1.91MB,51.76MB
test,11:33,20.2TB,51.6MB,252.5GB,2.1MB,-2207289,-2.11MB,51.63MB
test,11:34,20.2TB,50.1MB,252.5GB,1.9MB,-2033556,-1.94MB,50.05MB
test,11:35,20.2TB,50.7MB,252.5GB,1.9MB,-1981296.833,-1.89MB,50.71MB
test,11:36,20.2TB,51.5MB,252.5GB,1.8MB,-1934939.5,-1.85MB,51.52MB
test,11:37,20.2TB,36MB,252.5GB,1.3MB,-1369680.333,-1.31MB,35.99MB
test,11:38,171.2KB,-20.2TB,582KB,-252.5GB,271167669363.5,252.54GB,-20.16TB
test,11:39,11.5MB,11.4MB,1.7MB,1.1MB,-1163582.833,-1.11MB,11.37MB
test,11:40,7.6MB,-4MB,887.3KB,-831.1KB,850995.633,831.05KB,-3.96MB
test,11:41,1.5MB,-6.1MB,1MB,174.8KB,-178988.467,-174.79KB,-6.11MB
test,11:42,3.7MB,2.3MB,2.2MB,1.1MB,-1205321.833,-1.15MB,2.26MB
test,11:43,4.9MB,1.1MB,3.2MB,1MB,-1055192,-1.01MB,1.14MB
test,11:44,6.2MB,1.3MB,4.2MB,986.3KB,-1010000,-986.33KB,1.29MB
test,11:45,7.1MB,963.8KB,5MB,894.9KB,-916378.667,-894.90KB,963.78KB
test,11:46,8.5MB,1.4MB,6.1MB,1MB,-1079077.833,-1.03MB,1.42MB
test,11:47,9.7MB,1.1MB,6.9MB,878.1KB,-899125.167,-878.05KB,1.14MB
test,11:48,11.1MB,1.4MB,7.9MB,988.6KB,-1012284,-988.56KB,1.44MB
test,11:49,12MB,935.9KB,8.6MB,695.1KB,-711801.167,-695.12KB,935.87KB
20-minute timeframe
"Top values of host.name","@timestamp per 30 seconds","Part of Out","Part of Out","Part of In","Part of In","Part of In",In,Out
test,"11:30:00","20.2TB",,"252.5GB",,,,
test,"11:30:30","20.2TB","25.3MB","252.5GB","972.2KB","-995,567.667","-972.23KB","25.30MB"
test,"11:31:00","20.2TB","25.6MB","252.5GB","950.5KB","-973,328.667","-950.52KB","25.58MB"
test,"11:31:30","20.2TB","24.7MB","252.5GB","958.4KB","-981,441.333","-958.44KB","24.73MB"
test,"11:32:00","20.2TB","26.4MB","252.5GB","975.4KB","-998,816.333","-975.41KB","26.39MB"
test,"11:32:30","20.2TB",26MB,"252.5GB","998.4KB","-1,022,382.333","-998.42KB","26.01MB"
test,"11:33:00","20.2TB","25.4MB","252.5GB","1.1MB","-1,139,341","-1.09MB","25.37MB"
test,"11:33:30","20.2TB","26.5MB","252.5GB","1.1MB","-1,113,513.667","-1.06MB","26.52MB"
test,"11:34:00","20.2TB","24.4MB","252.5GB","968.5KB","-991,768","-968.52KB","24.43MB"
test,"11:34:30","20.2TB","24.7MB","252.5GB","947.3KB","-970,062.333","-947.33KB","24.73MB"
test,"11:35:00","20.2TB","25.3MB","252.5GB","977.1KB","-1,000,556","-977.11KB","25.35MB"
test,"11:35:30","20.2TB",26MB,"252.5GB","968.2KB","-991,419.333","-968.18KB","26.01MB"
test,"11:36:00","20.2TB","25.7MB","252.5GB","919.3KB","-941,387.333","-919.32KB","25.67MB"
test,"11:36:30","20.2TB","25.7MB","252.5GB","972.3KB","-995,685","-972.35KB","25.69MB"
test,"11:37:00","20.2TB","23.1MB","252.5GB","851.4KB","-871,837.833","-851.40KB","23.15MB"
test,"11:37:30",,,,,,,
test,"11:38:00","41.9KB",,"319.2KB",,,,
test,"11:38:30","214.3KB","172.4KB","669.6KB","350.4KB","-358,829.333","-350.42KB","172.41KB"
test,"11:39:00","1.8MB","1.6MB","1.2MB","535.9KB","-548,791.667","-535.93KB","1.61MB"
test,"11:39:30","21.3MB","19.4MB","2.2MB",1MB,"-1,050,167.667","-1.00MB","19.43MB"
test,"11:40:00","18.7MB","-2.6MB","1.5MB","-660.7KB","676,508.667","660.65KB","-2.57MB"
test,"11:40:30","184.8KB","-18.5MB","431.8KB","-1.1MB","1,165,951.333","1.11MB","-18.50MB"
test,"11:41:00","493.6KB","308.8KB","651.6KB","219.8KB","-225,030.667","-219.76KB","308.83KB"
test,"11:41:30","2.5MB",2MB,"1.4MB",821KB,"-840,676.667","-820.97KB","1.97MB"
test,"11:42:00","3.4MB","1,007.8KB","1.9MB","522.6KB","-535,127.667","-522.59KB","1,007.85KB"
test,"11:42:30",4MB,"595.4KB","2.4MB",488KB,"-499,711.667","-488.00KB","595.36KB"
test,"11:43:00","4.6MB",543KB,"2.9MB","530.4KB","-543,088","-530.36KB","542.96KB"
test,"11:43:30","5.2MB","660.9KB","3.4MB","512.2KB","-524,496.333","-512.20KB","660.90KB"
test,"11:44:00",6MB,"778.3KB",4MB,"531.2KB","-543,921","-531.17KB","778.28KB"
test,"11:44:30","6.4MB","434.4KB","4.4MB","398.1KB","-407,661.667","-398.11KB","434.43KB"
test,"11:45:00","6.8MB","468.4KB","4.8MB",441KB,"-451,579","-441.00KB","468.38KB"
test,"11:45:30","7.4MB","556.4KB","5.3MB","509.7KB","-521,937.667","-509.70KB","556.39KB"
test,"11:46:00","8.1MB","765.2KB","5.8MB",555KB,"-568,361.667","-555.04KB","765.21KB"
test,"11:46:30","8.9MB","823.1KB","6.3MB","487.8KB","-499,494.667","-487.79KB","823.10KB"
test,"11:47:00","9.4MB",493KB,"6.7MB","407.9KB","-417,652.667","-407.86KB","492.98KB"
test,"11:47:30","9.9MB","520.9KB","7.1MB","452.6KB","-463,450.333","-452.59KB","520.89KB"
test,"11:48:00","10.8MB","898.7KB","7.7MB","566.7KB","-580,339","-566.74KB","898.72KB"
test,"11:48:30","11.4MB","622.5KB","8.1MB","391.1KB","-400,439.667","-391.05KB","622.47KB"
test,"11:49:00","11.8MB","437.7KB","8.4MB","344.6KB","-352,887","-344.62KB","437.67KB"
test,"11:49:30","12.2MB","373.9KB","8.7MB","309.9KB","-317,388.667","-309.95KB","373.93KB"
Can you share the Inspect > request & response?
From the second graph, it looks like 20TB spike only hidden in the missing period.
Sure, here they are.
Request (40-minute)
{
"aggs": {
"0": {
"terms": {
"field": "host.name",
"order": {
"_key": "asc"
},
"size": 16
},
"aggs": {
"1": {
"date_histogram": {
"field": "@timestamp",
"calendar_interval": "1m",
"time_zone": "Asia/Singapore"
},
"aggs": {
"2": {
"avg": {
"field": "system.network.out.bytes"
}
},
"3": {
"avg": {
"field": "system.network.in.bytes"
}
}
}
}
}
}
},
"size": 0,
"fields": [
{
"field": "@timestamp",
"format": "date_time"
},
{
"field": "azure.app_insights.end_date",
"format": "date_time"
},
{
"field": "azure.app_insights.start_date",
"format": "date_time"
},
{
"field": "azure.app_state.end_date",
"format": "date_time"
},
{
"field": "azure.app_state.start_date",
"format": "date_time"
},
{
"field": "azure.billing.usage_date",
"format": "date_time"
},
{
"field": "azure.billing.usage_end",
"format": "date_time"
},
{
"field": "azure.billing.usage_start",
"format": "date_time"
},
{
"field": "ceph.monitor_health.last_updated",
"format": "date_time"
},
{
"field": "code_signature.timestamp",
"format": "date_time"
},
{
"field": "dll.code_signature.timestamp",
"format": "date_time"
},
{
"field": "docker.container.created",
"format": "date_time"
},
{
"field": "docker.healthcheck.event.end_date",
"format": "date_time"
},
{
"field": "docker.healthcheck.event.start_date",
"format": "date_time"
},
{
"field": "docker.image.created",
"format": "date_time"
},
{
"field": "elf.creation_date",
"format": "date_time"
},
{
"field": "event.created",
"format": "date_time"
},
{
"field": "event.end",
"format": "date_time"
},
{
"field": "event.ingested",
"format": "date_time"
},
{
"field": "event.start",
"format": "date_time"
},
{
"field": "file.accessed",
"format": "date_time"
},
{
"field": "file.code_signature.timestamp",
"format": "date_time"
},
{
"field": "file.created",
"format": "date_time"
},
{
"field": "file.ctime",
"format": "date_time"
},
{
"field": "file.elf.creation_date",
"format": "date_time"
},
{
"field": "file.mtime",
"format": "date_time"
},
{
"field": "file.x509.not_after",
"format": "date_time"
},
{
"field": "file.x509.not_before",
"format": "date_time"
},
{
"field": "kubernetes.container.start_time",
"format": "date_time"
},
{
"field": "kubernetes.event.metadata.timestamp.created",
"format": "date_time"
},
{
"field": "kubernetes.event.timestamp.first_occurrence",
"format": "date_time"
},
{
"field": "kubernetes.event.timestamp.last_occurrence",
"format": "date_time"
},
{
"field": "kubernetes.job.time.completed",
"format": "date_time"
},
{
"field": "kubernetes.job.time.created",
"format": "date_time"
},
{
"field": "kubernetes.node.start_time",
"format": "date_time"
},
{
"field": "kubernetes.pod.start_time",
"format": "date_time"
},
{
"field": "kubernetes.service.created",
"format": "date_time"
},
{
"field": "kubernetes.storageclass.created",
"format": "date_time"
},
{
"field": "kubernetes.system.start_time",
"format": "date_time"
},
{
"field": "mongodb.replstatus.server_date",
"format": "date_time"
},
{
"field": "mongodb.status.background_flushing.last_finished",
"format": "date_time"
},
{
"field": "mongodb.status.local_time",
"format": "date_time"
},
{
"field": "mssql.transaction_log.stats.backup_time",
"format": "date_time"
},
{
"field": "mysql.performance.events_statements.last.seen",
"format": "date_time"
},
{
"field": "nats.server.time",
"format": "date_time"
},
{
"field": "package.installed",
"format": "date_time"
},
{
"field": "php_fpm.pool.start_time",
"format": "date_time"
},
{
"field": "php_fpm.process.start_time",
"format": "date_time"
},
{
"field": "postgresql.activity.backend_start",
"format": "date_time"
},
{
"field": "postgresql.activity.query_start",
"format": "date_time"
},
{
"field": "postgresql.activity.state_change",
"format": "date_time"
},
{
"field": "postgresql.activity.transaction_start",
"format": "date_time"
},
{
"field": "postgresql.bgwriter.stats_reset",
"format": "date_time"
},
{
"field": "postgresql.database.stats_reset",
"format": "date_time"
},
{
"field": "process.code_signature.timestamp",
"format": "date_time"
},
{
"field": "process.cpu.start_time",
"format": "date_time"
},
{
"field": "process.elf.creation_date",
"format": "date_time"
},
{
"field": "process.end",
"format": "date_time"
},
{
"field": "process.parent.code_signature.timestamp",
"format": "date_time"
},
{
"field": "process.parent.elf.creation_date",
"format": "date_time"
},
{
"field": "process.parent.end",
"format": "date_time"
},
{
"field": "process.parent.start",
"format": "date_time"
},
{
"field": "process.start",
"format": "date_time"
},
{
"field": "system.process.cpu.start_time",
"format": "date_time"
},
{
"field": "system.service.state_since",
"format": "date_time"
},
{
"field": "threat.enrichments.indicator.file.accessed",
"format": "date_time"
},
{
"field": "threat.enrichments.indicator.file.code_signature.timestamp",
"format": "date_time"
},
{
"field": "threat.enrichments.indicator.file.created",
"format": "date_time"
},
{
"field": "threat.enrichments.indicator.file.ctime",
"format": "date_time"
},
{
"field": "threat.enrichments.indicator.file.elf.creation_date",
"format": "date_time"
},
{
"field": "threat.enrichments.indicator.file.mtime",
"format": "date_time"
},
{
"field": "threat.enrichments.indicator.first_seen",
"format": "date_time"
},
{
"field": "threat.enrichments.indicator.last_seen",
"format": "date_time"
},
{
"field": "threat.enrichments.indicator.modified_at",
"format": "date_time"
},
{
"field": "threat.enrichments.indicator.x509.not_after",
"format": "date_time"
},
{
"field": "threat.enrichments.indicator.x509.not_before",
"format": "date_time"
},
{
"field": "threat.indicator.file.accessed",
"format": "date_time"
},
{
"field": "threat.indicator.file.code_signature.timestamp",
"format": "date_time"
},
{
"field": "threat.indicator.file.created",
"format": "date_time"
},
{
"field": "threat.indicator.file.ctime",
"format": "date_time"
},
{
"field": "threat.indicator.file.elf.creation_date",
"format": "date_time"
},
{
"field": "threat.indicator.file.mtime",
"format": "date_time"
},
{
"field": "threat.indicator.first_seen",
"format": "date_time"
},
{
"field": "threat.indicator.last_seen",
"format": "date_time"
},
{
"field": "threat.indicator.modified_at",
"format": "date_time"
},
{
"field": "threat.indicator.x509.not_after",
"format": "date_time"
},
{
"field": "threat.indicator.x509.not_before",
"format": "date_time"
},
{
"field": "tls.client.not_after",
"format": "date_time"
},
{
"field": "tls.client.not_before",
"format": "date_time"
},
{
"field": "tls.client.x509.not_after",
"format": "date_time"
},
{
"field": "tls.client.x509.not_before",
"format": "date_time"
},
{
"field": "tls.server.not_after",
"format": "date_time"
},
{
"field": "tls.server.not_before",
"format": "date_time"
},
{
"field": "tls.server.x509.not_after",
"format": "date_time"
},
{
"field": "tls.server.x509.not_before",
"format": "date_time"
},
{
"field": "x509.not_after",
"format": "date_time"
},
{
"field": "x509.not_before",
"format": "date_time"
},
{
"field": "zookeeper.server.version_date",
"format": "date_time"
}
],
"script_fields": {},
"stored_fields": [
"*"
],
"runtime_mappings": {},
"_source": {
"excludes": []
},
"query": {
"bool": {
"must": [],
"filter": [
{
"bool": {
"should": [
{
"match_phrase": {
"system.network.name": "eth0"
}
}
],
"minimum_should_match": 1
}
},
{
"match_phrase": {
"host.name": "test"
}
},
{
"range": {
"@timestamp": {
"format": "strict_date_optional_time",
"gte": "2022-02-07T03:10:00.000Z",
"lte": "2022-02-07T03:50:00.000Z"
}
}
}
],
"should": [],
"must_not": []
}
}
}
Response (40-minute)
{
"id": "FmZoT3pMeDQwVHFTUEhJT2xjZkV2NFEeT2I3aGhuRHhUOS05YWNhTHpFRkpNQTo5NjYyNzU1",
"rawResponse": {
"took": 13,
"timed_out": false,
"_shards": {
"total": 44,
"successful": 44,
"skipped": 41,
"failed": 0
},
"hits": {
"total": 233,
"max_score": null,
"hits": []
},
"aggregations": {
"0": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"1": {
"buckets": [
{
"2": {
"value": 22160848083910.168
},
"3": {
"value": 271114423890
},
"key_as_string": "2022-02-07T11:10:00.000+08:00",
"key": 1644203400000,
"doc_count": 6
},
{
"2": {
"value": 22160902954440.332
},
"3": {
"value": 271116378025.16666
},
"key_as_string": "2022-02-07T11:11:00.000+08:00",
"key": 1644203460000,
"doc_count": 6
},
{
"2": {
"value": 22160957967831.332
},
"3": {
"value": 271118493845.5
},
"key_as_string": "2022-02-07T11:12:00.000+08:00",
"key": 1644203520000,
"doc_count": 6
},
{
"2": {
"value": 22161012706061.5
},
"3": {
"value": 271120532496.16666
},
"key_as_string": "2022-02-07T11:13:00.000+08:00",
"key": 1644203580000,
"doc_count": 6
},
{
"2": {
"value": 22161067459694.332
},
"3": {
"value": 271122635198.16666
},
"key_as_string": "2022-02-07T11:14:00.000+08:00",
"key": 1644203640000,
"doc_count": 6
},
{
"2": {
"value": 22161120312217.668
},
"3": {
"value": 271124545871
},
"key_as_string": "2022-02-07T11:15:00.000+08:00",
"key": 1644203700000,
"doc_count": 6
},
{
"2": {
"value": 22161174558173.832
},
"3": {
"value": 271126409475.66666
},
"key_as_string": "2022-02-07T11:16:00.000+08:00",
"key": 1644203760000,
"doc_count": 6
},
{
"2": {
"value": 22161228596656.168
},
"3": {
"value": 271128352950.66666
},
"key_as_string": "2022-02-07T11:17:00.000+08:00",
"key": 1644203820000,
"doc_count": 6
},
{
"2": {
"value": 22161283396516.832
},
"3": {
"value": 271130528431.33334
},
"key_as_string": "2022-02-07T11:18:00.000+08:00",
"key": 1644203880000,
"doc_count": 6
},
{
"2": {
"value": 22161340073264.332
},
"3": {
"value": 271132601657.66666
},
"key_as_string": "2022-02-07T11:19:00.000+08:00",
"key": 1644203940000,
"doc_count": 6
},
{
"2": {
"value": 22161395167586.5
},
"3": {
"value": 271134626814
},
"key_as_string": "2022-02-07T11:20:00.000+08:00",
"key": 1644204000000,
"doc_count": 6
},
{
"2": {
"value": 22161449340119.168
},
"3": {
"value": 271136661673.66666
},
"key_as_string": "2022-02-07T11:21:00.000+08:00",
"key": 1644204060000,
"doc_count": 6
},
{
"2": {
"value": 22161504324772.168
},
"3": {
"value": 271138715615.5
},
"key_as_string": "2022-02-07T11:22:00.000+08:00",
"key": 1644204120000,
"doc_count": 6
},
{
"2": {
"value": 22161560995022.668
},
"3": {
"value": 271140790684.83334
},
"key_as_string": "2022-02-07T11:23:00.000+08:00",
"key": 1644204180000,
"doc_count": 6
},
{
"2": {
"value": 22161616740127.668
},
"3": {
"value": 271142825522.16666
},
"key_as_string": "2022-02-07T11:24:00.000+08:00",
"key": 1644204240000,
"doc_count": 6
},
{
"2": {
"value": 22161671917191.168
},
"3": {
"value": 271144858301.83334
},
"key_as_string": "2022-02-07T11:25:00.000+08:00",
"key": 1644204300000,
"doc_count": 6
},
{
"2": {
"value": 22161725983198
},
"3": {
"value": 271146845144.33334
},
"key_as_string": "2022-02-07T11:26:00.000+08:00",
"key": 1644204360000,
"doc_count": 6
},
{
"2": {
"value": 22161777976258.832
},
"3": {
"value": 271148789142.16666
},
"key_as_string": "2022-02-07T11:27:00.000+08:00",
"key": 1644204420000,
"doc_count": 6
},
{
"2": {
"value": 22161833063964
},
"3": {
"value": 271150774119.5
},
"key_as_string": "2022-02-07T11:28:00.000+08:00",
"key": 1644204480000,
"doc_count": 6
},
{
"2": {
"value": 22161886999312.668
},
"3": {
"value": 271152785802.5
},
"key_as_string": "2022-02-07T11:29:00.000+08:00",
"key": 1644204540000,
"doc_count": 6
},
{
"2": {
"value": 22161940337997.832
},
"3": {
"value": 271154776030.5
},
"key_as_string": "2022-02-07T11:30:00.000+08:00",
"key": 1644204600000,
"doc_count": 6
},
{
"2": {
"value": 22161993392293.5
},
"3": {
"value": 271156737863.66666
},
"key_as_string": "2022-02-07T11:31:00.000+08:00",
"key": 1644204660000,
"doc_count": 6
},
{
"2": {
"value": 22162047662449.832
},
"3": {
"value": 271158738591.83334
},
"key_as_string": "2022-02-07T11:32:00.000+08:00",
"key": 1644204720000,
"doc_count": 6
},
{
"2": {
"value": 22162101801895
},
"3": {
"value": 271160945880.83334
},
"key_as_string": "2022-02-07T11:33:00.000+08:00",
"key": 1644204780000,
"doc_count": 6
},
{
"2": {
"value": 22162154287854.332
},
"3": {
"value": 271162979436.83334
},
"key_as_string": "2022-02-07T11:34:00.000+08:00",
"key": 1644204840000,
"doc_count": 6
},
{
"2": {
"value": 22162207466357.832
},
"3": {
"value": 271164960733.66666
},
"key_as_string": "2022-02-07T11:35:00.000+08:00",
"key": 1644204900000,
"doc_count": 6
},
{
"2": {
"value": 22162261488147.5
},
"3": {
"value": 271166895673.16666
},
"key_as_string": "2022-02-07T11:36:00.000+08:00",
"key": 1644204960000,
"doc_count": 6
},
{
"2": {
"value": 22162299231197
},
"3": {
"value": 271168265353.5
},
"key_as_string": "2022-02-07T11:37:00.000+08:00",
"key": 1644205020000,
"doc_count": 2
},
{
"2": {
"value": 175338
},
"3": {
"value": 595990
},
"key_as_string": "2022-02-07T11:38:00.000+08:00",
"key": 1644205080000,
"doc_count": 4
},
{
"2": {
"value": 12097191
},
"3": {
"value": 1759572.8333333333
},
"key_as_string": "2022-02-07T11:39:00.000+08:00",
"key": 1644205140000,
"doc_count": 6
},
{
"2": {
"value": 7947453.6
},
"3": {
"value": 908577.2
},
"key_as_string": "2022-02-07T11:40:00.000+08:00",
"key": 1644205200000,
"doc_count": 5
},
{
"2": {
"value": 1540173
},
"3": {
"value": 1087565.6666666667
},
"key_as_string": "2022-02-07T11:41:00.000+08:00",
"key": 1644205260000,
"doc_count": 6
},
{
"2": {
"value": 3911765.1666666665
},
"3": {
"value": 2292887.5
},
"key_as_string": "2022-02-07T11:42:00.000+08:00",
"key": 1644205320000,
"doc_count": 6
},
{
"2": {
"value": 5110963
},
"3": {
"value": 3348079.5
},
"key_as_string": "2022-02-07T11:43:00.000+08:00",
"key": 1644205380000,
"doc_count": 6
},
{
"2": {
"value": 6468723.833333333
},
"3": {
"value": 4358079.5
},
"key_as_string": "2022-02-07T11:44:00.000+08:00",
"key": 1644205440000,
"doc_count": 6
},
{
"2": {
"value": 7455638.5
},
"3": {
"value": 5274458.166666667
},
"key_as_string": "2022-02-07T11:45:00.000+08:00",
"key": 1644205500000,
"doc_count": 6
},
{
"2": {
"value": 8945508.5
},
"3": {
"value": 6353536
},
"key_as_string": "2022-02-07T11:46:00.000+08:00",
"key": 1644205560000,
"doc_count": 6
},
{
"2": {
"value": 10138435.166666666
},
"3": {
"value": 7252661.166666667
},
"key_as_string": "2022-02-07T11:47:00.000+08:00",
"key": 1644205620000,
"doc_count": 6
},
{
"2": {
"value": 11644125
},
"3": {
"value": 8264945.166666667
},
"key_as_string": "2022-02-07T11:48:00.000+08:00",
"key": 1644205680000,
"doc_count": 6
},
{
"2": {
"value": 12602452
},
"3": {
"value": 8976746.333333334
},
"key_as_string": "2022-02-07T11:49:00.000+08:00",
"key": 1644205740000,
"doc_count": 6
}
]
},
"key": "test",
"doc_count": 233
}
]
}
}
},
"isPartial": false,
"isRunning": false,
"total": 44,
"loaded": 44,
"isRestored": false
}
Request (20-minute)
{
"aggs": {
"0": {
"terms": {
"field": "host.name",
"order": {
"_key": "asc"
},
"size": 16
},
"aggs": {
"1": {
"date_histogram": {
"field": "@timestamp",
"fixed_interval": "30s",
"time_zone": "Asia/Singapore"
},
"aggs": {
"2": {
"avg": {
"field": "system.network.out.bytes"
}
},
"3": {
"avg": {
"field": "system.network.in.bytes"
}
}
}
}
}
}
},
"size": 0,
"fields": [
{
"field": "@timestamp",
"format": "date_time"
},
{
"field": "azure.app_insights.end_date",
"format": "date_time"
},
{
"field": "azure.app_insights.start_date",
"format": "date_time"
},
{
"field": "azure.app_state.end_date",
"format": "date_time"
},
{
"field": "azure.app_state.start_date",
"format": "date_time"
},
{
"field": "azure.billing.usage_date",
"format": "date_time"
},
{
"field": "azure.billing.usage_end",
"format": "date_time"
},
{
"field": "azure.billing.usage_start",
"format": "date_time"
},
{
"field": "ceph.monitor_health.last_updated",
"format": "date_time"
},
{
"field": "code_signature.timestamp",
"format": "date_time"
},
{
"field": "dll.code_signature.timestamp",
"format": "date_time"
},
{
"field": "docker.container.created",
"format": "date_time"
},
{
"field": "docker.healthcheck.event.end_date",
"format": "date_time"
},
{
"field": "docker.healthcheck.event.start_date",
"format": "date_time"
},
{
"field": "docker.image.created",
"format": "date_time"
},
{
"field": "elf.creation_date",
"format": "date_time"
},
{
"field": "event.created",
"format": "date_time"
},
{
"field": "event.end",
"format": "date_time"
},
{
"field": "event.ingested",
"format": "date_time"
},
{
"field": "event.start",
"format": "date_time"
},
{
"field": "file.accessed",
"format": "date_time"
},
{
"field": "file.code_signature.timestamp",
"format": "date_time"
},
{
"field": "file.created",
"format": "date_time"
},
{
"field": "file.ctime",
"format": "date_time"
},
{
"field": "file.elf.creation_date",
"format": "date_time"
},
{
"field": "file.mtime",
"format": "date_time"
},
{
"field": "file.x509.not_after",
"format": "date_time"
},
{
"field": "file.x509.not_before",
"format": "date_time"
},
{
"field": "kubernetes.container.start_time",
"format": "date_time"
},
{
"field": "kubernetes.event.metadata.timestamp.created",
"format": "date_time"
},
{
"field": "kubernetes.event.timestamp.first_occurrence",
"format": "date_time"
},
{
"field": "kubernetes.event.timestamp.last_occurrence",
"format": "date_time"
},
{
"field": "kubernetes.job.time.completed",
"format": "date_time"
},
{
"field": "kubernetes.job.time.created",
"format": "date_time"
},
{
"field": "kubernetes.node.start_time",
"format": "date_time"
},
{
"field": "kubernetes.pod.start_time",
"format": "date_time"
},
{
"field": "kubernetes.service.created",
"format": "date_time"
},
{
"field": "kubernetes.storageclass.created",
"format": "date_time"
},
{
"field": "kubernetes.system.start_time",
"format": "date_time"
},
{
"field": "mongodb.replstatus.server_date",
"format": "date_time"
},
{
"field": "mongodb.status.background_flushing.last_finished",
"format": "date_time"
},
{
"field": "mongodb.status.local_time",
"format": "date_time"
},
{
"field": "mssql.transaction_log.stats.backup_time",
"format": "date_time"
},
{
"field": "mysql.performance.events_statements.last.seen",
"format": "date_time"
},
{
"field": "nats.server.time",
"format": "date_time"
},
{
"field": "package.installed",
"format": "date_time"
},
{
"field": "php_fpm.pool.start_time",
"format": "date_time"
},
{
"field": "php_fpm.process.start_time",
"format": "date_time"
},
{
"field": "postgresql.activity.backend_start",
"format": "date_time"
},
{
"field": "postgresql.activity.query_start",
"format": "date_time"
},
{
"field": "postgresql.activity.state_change",
"format": "date_time"
},
{
"field": "postgresql.activity.transaction_start",
"format": "date_time"
},
{
"field": "postgresql.bgwriter.stats_reset",
"format": "date_time"
},
{
"field": "postgresql.database.stats_reset",
"format": "date_time"
},
{
"field": "process.code_signature.timestamp",
"format": "date_time"
},
{
"field": "process.cpu.start_time",
"format": "date_time"
},
{
"field": "process.elf.creation_date",
"format": "date_time"
},
{
"field": "process.end",
"format": "date_time"
},
{
"field": "process.parent.code_signature.timestamp",
"format": "date_time"
},
{
"field": "process.parent.elf.creation_date",
"format": "date_time"
},
{
"field": "process.parent.end",
"format": "date_time"
},
{
"field": "process.parent.start",
"format": "date_time"
},
{
"field": "process.start",
"format": "date_time"
},
{
"field": "system.process.cpu.start_time",
"format": "date_time"
},
{
"field": "system.service.state_since",
"format": "date_time"
},
{
"field": "threat.enrichments.indicator.file.accessed",
"format": "date_time"
},
{
"field": "threat.enrichments.indicator.file.code_signature.timestamp",
"format": "date_time"
},
{
"field": "threat.enrichments.indicator.file.created",
"format": "date_time"
},
{
"field": "threat.enrichments.indicator.file.ctime",
"format": "date_time"
},
{
"field": "threat.enrichments.indicator.file.elf.creation_date",
"format": "date_time"
},
{
"field": "threat.enrichments.indicator.file.mtime",
"format": "date_time"
},
{
"field": "threat.enrichments.indicator.first_seen",
"format": "date_time"
},
{
"field": "threat.enrichments.indicator.last_seen",
"format": "date_time"
},
{
"field": "threat.enrichments.indicator.modified_at",
"format": "date_time"
},
{
"field": "threat.enrichments.indicator.x509.not_after",
"format": "date_time"
},
{
"field": "threat.enrichments.indicator.x509.not_before",
"format": "date_time"
},
{
"field": "threat.indicator.file.accessed",
"format": "date_time"
},
{
"field": "threat.indicator.file.code_signature.timestamp",
"format": "date_time"
},
{
"field": "threat.indicator.file.created",
"format": "date_time"
},
{
"field": "threat.indicator.file.ctime",
"format": "date_time"
},
{
"field": "threat.indicator.file.elf.creation_date",
"format": "date_time"
},
{
"field": "threat.indicator.file.mtime",
"format": "date_time"
},
{
"field": "threat.indicator.first_seen",
"format": "date_time"
},
{
"field": "threat.indicator.last_seen",
"format": "date_time"
},
{
"field": "threat.indicator.modified_at",
"format": "date_time"
},
{
"field": "threat.indicator.x509.not_after",
"format": "date_time"
},
{
"field": "threat.indicator.x509.not_before",
"format": "date_time"
},
{
"field": "tls.client.not_after",
"format": "date_time"
},
{
"field": "tls.client.not_before",
"format": "date_time"
},
{
"field": "tls.client.x509.not_after",
"format": "date_time"
},
{
"field": "tls.client.x509.not_before",
"format": "date_time"
},
{
"field": "tls.server.not_after",
"format": "date_time"
},
{
"field": "tls.server.not_before",
"format": "date_time"
},
{
"field": "tls.server.x509.not_after",
"format": "date_time"
},
{
"field": "tls.server.x509.not_before",
"format": "date_time"
},
{
"field": "x509.not_after",
"format": "date_time"
},
{
"field": "x509.not_before",
"format": "date_time"
},
{
"field": "zookeeper.server.version_date",
"format": "date_time"
}
],
"script_fields": {},
"stored_fields": [
"*"
],
"runtime_mappings": {},
"_source": {
"excludes": []
},
"query": {
"bool": {
"must": [],
"filter": [
{
"bool": {
"should": [
{
"match_phrase": {
"system.network.name": "eth0"
}
}
],
"minimum_should_match": 1
}
},
{
"match_phrase": {
"host.name": "test"
}
},
{
"range": {
"@timestamp": {
"format": "strict_date_optional_time",
"gte": "2022-02-07T03:30:00.000Z",
"lte": "2022-02-07T03:50:00.000Z"
}
}
}
],
"should": [],
"must_not": []
}
}
}
Response (20-minute)
{
"id": "Fms4NnRhSHhnVFEycTRCTXM2SXZnZ1EeT2I3aGhuRHhUOS05YWNhTHpFRkpNQTo5NjY1NDMz",
"rawResponse": {
"took": 13,
"timed_out": false,
"_shards": {
"total": 44,
"successful": 44,
"skipped": 41,
"failed": 0
},
"hits": {
"total": 113,
"max_score": null,
"hits": []
},
"aggregations": {
"0": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"1": {
"buckets": [
{
"2": {
"value": 22161927073642.332
},
"3": {
"value": 271154278246.66666
},
"key_as_string": "2022-02-07T11:30:00.000+08:00",
"key": 1644204600000,
"doc_count": 3
},
{
"2": {
"value": 22161953602353.332
},
"3": {
"value": 271155273814.33334
},
"key_as_string": "2022-02-07T11:30:30.000+08:00",
"key": 1644204630000,
"doc_count": 3
},
{
"2": {
"value": 22161980429187.332
},
"3": {
"value": 271156247143
},
"key_as_string": "2022-02-07T11:31:00.000+08:00",
"key": 1644204660000,
"doc_count": 3
},
{
"2": {
"value": 22162006355399.668
},
"3": {
"value": 271157228584.33334
},
"key_as_string": "2022-02-07T11:31:30.000+08:00",
"key": 1644204690000,
"doc_count": 3
},
{
"2": {
"value": 22162034024913.332
},
"3": {
"value": 271158227400.66666
},
"key_as_string": "2022-02-07T11:32:00.000+08:00",
"key": 1644204720000,
"doc_count": 3
},
{
"2": {
"value": 22162061299986.332
},
"3": {
"value": 271159249783
},
"key_as_string": "2022-02-07T11:32:30.000+08:00",
"key": 1644204750000,
"doc_count": 3
},
{
"2": {
"value": 22162087898330.332
},
"3": {
"value": 271160389124
},
"key_as_string": "2022-02-07T11:33:00.000+08:00",
"key": 1644204780000,
"doc_count": 3
},
{
"2": {
"value": 22162115705459.668
},
"3": {
"value": 271161502637.66666
},
"key_as_string": "2022-02-07T11:33:30.000+08:00",
"key": 1644204810000,
"doc_count": 3
},
{
"2": {
"value": 22162141324149.668
},
"3": {
"value": 271162494405.66666
},
"key_as_string": "2022-02-07T11:34:00.000+08:00",
"key": 1644204840000,
"doc_count": 3
},
{
"2": {
"value": 22162167251559
},
"3": {
"value": 271163464468
},
"key_as_string": "2022-02-07T11:34:30.000+08:00",
"key": 1644204870000,
"doc_count": 3
},
{
"2": {
"value": 22162193831158.668
},
"3": {
"value": 271164465024
},
"key_as_string": "2022-02-07T11:35:00.000+08:00",
"key": 1644204900000,
"doc_count": 3
},
{
"2": {
"value": 22162221101557
},
"3": {
"value": 271165456443.33334
},
"key_as_string": "2022-02-07T11:35:30.000+08:00",
"key": 1644204930000,
"doc_count": 3
},
{
"2": {
"value": 22162248016845.668
},
"3": {
"value": 271166397830.66666
},
"key_as_string": "2022-02-07T11:36:00.000+08:00",
"key": 1644204960000,
"doc_count": 3
},
{
"2": {
"value": 22162274959449.332
},
"3": {
"value": 271167393515.66666
},
"key_as_string": "2022-02-07T11:36:30.000+08:00",
"key": 1644204990000,
"doc_count": 3
},
{
"2": {
"value": 22162299231197
},
"3": {
"value": 271168265353.5
},
"key_as_string": "2022-02-07T11:37:00.000+08:00",
"key": 1644205020000,
"doc_count": 2
},
{
"2": {
"value": null
},
"3": {
"value": null
},
"key_as_string": "2022-02-07T11:37:30.000+08:00",
"key": 1644205050000,
"doc_count": 0
},
{
"2": {
"value": 42927
},
"3": {
"value": 326868
},
"key_as_string": "2022-02-07T11:38:00.000+08:00",
"key": 1644205080000,
"doc_count": 1
},
{
"2": {
"value": 219475
},
"3": {
"value": 685697.3333333334
},
"key_as_string": "2022-02-07T11:38:30.000+08:00",
"key": 1644205110000,
"doc_count": 3
},
{
"2": {
"value": 1910235.3333333333
},
"3": {
"value": 1234489
},
"key_as_string": "2022-02-07T11:39:00.000+08:00",
"key": 1644205140000,
"doc_count": 3
},
{
"2": {
"value": 22284146.666666668
},
"3": {
"value": 2284656.6666666665
},
"key_as_string": "2022-02-07T11:39:30.000+08:00",
"key": 1644205170000,
"doc_count": 3
},
{
"2": {
"value": 19584831.5
},
"3": {
"value": 1608148
},
"key_as_string": "2022-02-07T11:40:00.000+08:00",
"key": 1644205200000,
"doc_count": 2
},
{
"2": {
"value": 189201.66666666666
},
"3": {
"value": 442196.6666666667
},
"key_as_string": "2022-02-07T11:40:30.000+08:00",
"key": 1644205230000,
"doc_count": 3
},
{
"2": {
"value": 505442
},
"3": {
"value": 667227.3333333334
},
"key_as_string": "2022-02-07T11:41:00.000+08:00",
"key": 1644205260000,
"doc_count": 3
},
{
"2": {
"value": 2574904
},
"3": {
"value": 1507904
},
"key_as_string": "2022-02-07T11:41:30.000+08:00",
"key": 1644205290000,
"doc_count": 3
},
{
"2": {
"value": 3606940.6666666665
},
"3": {
"value": 2043031.6666666667
},
"key_as_string": "2022-02-07T11:42:00.000+08:00",
"key": 1644205320000,
"doc_count": 3
},
{
"2": {
"value": 4216589.666666667
},
"3": {
"value": 2542743.3333333335
},
"key_as_string": "2022-02-07T11:42:30.000+08:00",
"key": 1644205350000,
"doc_count": 3
},
{
"2": {
"value": 4772584.333333333
},
"3": {
"value": 3085831.3333333335
},
"key_as_string": "2022-02-07T11:43:00.000+08:00",
"key": 1644205380000,
"doc_count": 3
},
{
"2": {
"value": 5449341.666666667
},
"3": {
"value": 3610327.6666666665
},
"key_as_string": "2022-02-07T11:43:30.000+08:00",
"key": 1644205410000,
"doc_count": 3
},
{
"2": {
"value": 6246298
},
"3": {
"value": 4154248.6666666665
},
"key_as_string": "2022-02-07T11:44:00.000+08:00",
"key": 1644205440000,
"doc_count": 3
},
{
"2": {
"value": 6691149.666666667
},
"3": {
"value": 4561910.333333333
},
"key_as_string": "2022-02-07T11:44:30.000+08:00",
"key": 1644205470000,
"doc_count": 3
},
{
"2": {
"value": 7170766.666666667
},
"3": {
"value": 5013489.333333333
},
"key_as_string": "2022-02-07T11:45:00.000+08:00",
"key": 1644205500000,
"doc_count": 3
},
{
"2": {
"value": 7740510.333333333
},
"3": {
"value": 5535427
},
"key_as_string": "2022-02-07T11:45:30.000+08:00",
"key": 1644205530000,
"doc_count": 3
},
{
"2": {
"value": 8524082.333333334
},
"3": {
"value": 6103788.666666667
},
"key_as_string": "2022-02-07T11:46:00.000+08:00",
"key": 1644205560000,
"doc_count": 3
},
{
"2": {
"value": 9366934.666666666
},
"3": {
"value": 6603283.333333333
},
"key_as_string": "2022-02-07T11:46:30.000+08:00",
"key": 1644205590000,
"doc_count": 3
},
{
"2": {
"value": 9871742
},
"3": {
"value": 7020936
},
"key_as_string": "2022-02-07T11:47:00.000+08:00",
"key": 1644205620000,
"doc_count": 3
},
{
"2": {
"value": 10405128.333333334
},
"3": {
"value": 7484386.333333333
},
"key_as_string": "2022-02-07T11:47:30.000+08:00",
"key": 1644205650000,
"doc_count": 3
},
{
"2": {
"value": 11325419
},
"3": {
"value": 8064725.333333333
},
"key_as_string": "2022-02-07T11:48:00.000+08:00",
"key": 1644205680000,
"doc_count": 3
},
{
"2": {
"value": 11962831
},
"3": {
"value": 8465165
},
"key_as_string": "2022-02-07T11:48:30.000+08:00",
"key": 1644205710000,
"doc_count": 3
},
{
"2": {
"value": 12411002
},
"3": {
"value": 8818052
},
"key_as_string": "2022-02-07T11:49:00.000+08:00",
"key": 1644205740000,
"doc_count": 3
},
{
"2": {
"value": 12793902
},
"3": {
"value": 9135440.666666666
},
"key_as_string": "2022-02-07T11:49:30.000+08:00",
"key": 1644205770000,
"doc_count": 3
}
]
},
"key": "test",
"doc_count": 113
}
]
}
}
},
"isPartial": false,
"isRunning": false,
"total": 44,
"loaded": 44,
"isRestored": false
}