# Cumulative Values - X-PACK monitoring

**URL:** <https://discuss.elastic.co/t/cumulative-values-x-pack-monitoring/196578>\
**Category:** Beats\
**Tags:** elastic-stack-monitoring, filebeat\
**Created:** [August 23, 2019, 7:16pm UTC](https://discuss.elastic.co/t/cumulative-values-x-pack-monitoring/196578 "2019-08-23T19:16:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![leandro.borges](https://avatars.discourse-cdn.com/v4/letter/l/ce73a5/32.png) [@leandro.borges](https://discuss.elastic.co/u/leandro.borges)\
**Post date:** [August 23, 2019, 7:16pm UTC](https://discuss.elastic.co/t/cumulative-values-x-pack-monitoring/196578/1 "2019-08-23T19:16:56Z")

</div>

Hello

I activated the monitoring on a Filebeat to send monitoring information to Elasticsearch. Now, in my dashboard inside Kibana I have:

 ![img](https://us1.discourse-cdn.com/elastic/original/3X/2/f/2f049491f757d7a12a0a22c6a6b05165a0b35e64.png)

It shows the behaviour when filebeat is sending data.

When I try to create a request inside the Console of Kibana to get the values that ilustrates the chart above, the results are cumulative. In other words, the result of the field events.acked are cumulative:

```
GET %3C.monitoring-beats-6-%7Bnow%2Fd%7D%3E/_search
{
  "size": 0,
  "_source": [
    "beats_stats.beat.host",
    "beats_stats.timestamp",
    "beats_stats.metrics.libbeat.output.events.acked"
  ],
  "query": {
    "bool": {
      "must": [
        {
         "range": {
            "beats_stats.metrics.libbeat.output.events.acked": {
              "gte": 0
            }
          }
        },
        {
          "range": {
            "beats_stats.timestamp": {
              "gte": "now-30m"
            }
          }
        }
      ]
    }
  },
  "aggs": {
    "hosts": {
      "terms": {
        "field": "beats_stats.beat.host"
      },
      "aggs": {
        "acked": {
          "max": {
            "field": "beats_stats.metrics.libbeat.output.events.acked"
          }
        }
      }
    }
  }
}

```

And the result:

```
{
  "took" : 1,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 360,
    "max_score" : 0.0,
    "hits" : []
  },
  "aggregations" : {
    "hosts" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "SERVER1",
          "doc_count" : 180,
          "acked" : {
            **"value" : 1284893.0**
          }
        },
        {
          "key" : "SERVER2",
          "doc_count" : 180,
          "acked" : {
            "value" : 8231.0
          }
        }
      ]
    }
  }
}

```

The SERVER1 is the server ilustrated in the chart above.

And with this query I will get the sum of all values and not the value at that moment when Filebeat is sending data:

 ![png](https://us1.discourse-cdn.com/elastic/original/3X/2/d/2dd3c0de07260cd1c4fa84412fbf5646fe15bbf5.jpeg)

So the questions is: "How to construct a query that reflects that chart?". I used max in the agg above just to ilustrate.

Thanks!

---

<div class="post-metadata">

**Author:** ![chrisronline](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrisronline/32/28230_2.png) [@chrisronline](https://discuss.elastic.co/u/chrisronline)\
**Post date:** [September 9, 2019, 5:10pm UTC](https://discuss.elastic.co/t/cumulative-values-x-pack-monitoring/196578/2 "2019-09-09T17:10:31Z")

</div>

Hi @leandro.borges,

Welcome, and sorry for the delay in responding!

Yes, those values are cumulative, or counters. In order to obtain the values seen in the graph, you need to perform a [derivative aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-derivative-aggregation.html) over a sample time period. For all graphs in the stack monitoring UI, we normalize [the unit to 1s](https://github.com/elastic/kibana/blob/master/x-pack/legacy/plugins/monitoring/common/constants.js#L46)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 7, 2019, 5:10pm UTC](https://discuss.elastic.co/t/cumulative-values-x-pack-monitoring/196578/3 "2019-10-07T17:10:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.