Thanks, that looks nothing strange. You have to look into the documents itself. For example how are system.network.out.bytes and system.network.in.bytes of the documents from 2022-02-07T11:30:00.000+08:00 to
2022-02-07T11:31:00.000+08:00? Around ²⁰tb?
Yeah, the system.network.out.bytes was around 20TB.
{
"took": 7,
"timed_out": false,
"_shards": {
"total": 44,
"successful": 44,
"skipped": 0,
"failed": 0
},
"hits": {
"total": {
"value": 6,
"relation": "eq"
},
"max_score": 0.0,
"hits": [
{
"_index": "metricbeat-7.16.2-2022.02.07-000005",
"_type": "_doc",
"_id": "LTk70n4BW_XeLH3pg8Gz",
"_score": 0.0,
"_source": {
"@timestamp": "2022-02-07T03:30:21.764Z",
"system": {
"network": {
"in": {
"bytes": 271154595421,
"dropped": 0,
"packets": 2601038784,
"errors": 0
},
"name": "eth0",
"out": {
"bytes": 22161935901082,
"dropped": 0,
"errors": 0,
"packets": 2993968171
}
}
}
}
},
{
"_index": "metricbeat-7.16.2-2022.02.07-000005",
"_type": "_doc",
"_id": "Kzk70n4BW_XeLH3pXLyk",
"_score": 0.0,
"_source": {
"@timestamp": "2022-02-07T03:30:11.764Z",
"system": {
"network": {
"in": {
"bytes": 271154272882,
"dropped": 0,
"packets": 2601035189,
"errors": 0
},
"name": "eth0",
"out": {
"bytes": 22161926944563,
"dropped": 0,
"errors": 0,
"packets": 2993964311
}
}
}
}
},
{
"_index": "metricbeat-7.16.2-2022.02.07-000005",
"_type": "_doc",
"_id": "y_I70n4BAC5oU7efNaWb",
"_score": 0.0,
"_source": {
"@timestamp": "2022-02-07T03:30:01.764Z",
"system": {
"network": {
"in": {
"bytes": 271153966437,
"dropped": 0,
"errors": 0,
"packets": 2601031747
},
"name": "eth0",
"out": {
"bytes": 22161918375282,
"dropped": 0,
"packets": 2993960627,
"errors": 0
}
}
}
}
},
{
"_index": "metricbeat-7.16.2-2022.02.07-000005",
"_type": "_doc",
"_id": "ivI70n4BAC5oU7efqrLD",
"_score": 0.0,
"_source": {
"@timestamp": "2022-02-07T03:30:31.764Z",
"system": {
"network": {
"in": {
"bytes": 271154934755,
"dropped": 0,
"packets": 2601042461,
"errors": 0
},
"name": "eth0",
"out": {
"bytes": 22161944825210,
"dropped": 0,
"errors": 0,
"packets": 2993972095
}
}
}
}
},
{
"_index": "metricbeat-7.16.2-2022.02.07-000005",
"_type": "_doc",
"_id": "WDk70n4BW_XeLH3p0cvT",
"_score": 0.0,
"_source": {
"@timestamp": "2022-02-07T03:30:41.764Z",
"system": {
"network": {
"in": {
"bytes": 271155283728,
"dropped": 0,
"errors": 0,
"packets": 2601046080
},
"name": "eth0",
"out": {
"bytes": 22161953551923,
"dropped": 0,
"errors": 0,
"packets": 2993975987
}
}
}
}
},
{
"_index": "metricbeat-7.16.2-2022.02.07-000005",
"_type": "_doc",
"_id": "Wjk70n4BW_XeLH3p-NDj",
"_score": 0.0,
"_source": {
"@timestamp": "2022-02-07T03:30:51.764Z",
"system": {
"network": {
"in": {
"bytes": 271155602960,
"dropped": 0,
"packets": 2601049731,
"errors": 0
},
"name": "eth0",
"out": {
"bytes": 22161962429927,
"dropped": 0,
"errors": 0,
"packets": 2993979898
}
}
}
}
}
]
}
}
Then, what is wrong? The spike reflects the data. Rather, graphs with short time intervals failed to catch the spikes.
What actually happend is that after a slight gap, sharp decrease of network.in/out occured. It is possible something happend then, but it is beyonde this graph.
Anyway, as for the default strategy against missing values of original series for differences Formula, missing value: last could be safer. You may issue a feature request here, if you want.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.