# Draw error on logstash graphs skewing scale

**URL:** <https://discuss.elastic.co/t/draw-error-on-logstash-graphs-skewing-scale/83708>\
**Category:** Logstash\
**Created:** [April 26, 2017, 1:42pm UTC](https://discuss.elastic.co/t/draw-error-on-logstash-graphs-skewing-scale/83708 "2017-04-26T13:42:13Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![\_Ian](https://avatars.discourse-cdn.com/v4/letter/_/ccd318/32.png) [@\_Ian](https://discuss.elastic.co/u/_Ian)\
**Post date:** [April 26, 2017, 1:42pm UTC](https://discuss.elastic.co/t/draw-error-on-logstash-graphs-skewing-scale/83708/1 "2017-04-26T13:42:13Z")

</div>

![](https://us1.discourse-cdn.com/elastic/original/3X/9/6/9691441eda00048d26f71aa425c12b816b8176f2.png)

While watching a live tail of the events rate in the Logstash montitor the graphs are often broken by a render problem. It seems a large value is selected as the first datapoint (invalid) which throws off the graph draw scale significantly.

This is current in 5.3.1, using chrome browser.

---

<div class="post-metadata">

**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\
**Post date:** [April 26, 2017, 11:38pm UTC](https://discuss.elastic.co/t/draw-error-on-logstash-graphs-skewing-scale/83708/2 "2017-04-26T23:38:02Z")

</div>

Hi Ian,

Yes, that first initial spike could through off the scale so that smaller measurements after appear to essentially be 0. But I don't think that would explain the gap in data.

You could create an index pattern in Kibana like `.monitoring-logstash-*` and then look at that data in Discover and see if there's a gap. Based on that maybe we can investigate further.

Regards,  
Lee

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [April 27, 2017, 1:01am UTC](https://discuss.elastic.co/t/draw-error-on-logstash-graphs-skewing-scale/83708/3 "2017-04-27T01:01:16Z")

</div>

Hi,

There is an open issue in the closed-source Logstash Monitoring UI repo on this. The Logstash events rate metrics are derivatives of the max of `logstash_stats.events.in` and `logstash_stats.events.out` in the Logstash Monitoring data, and the first bucket bucket of the date histogram is drawing on partial information, which makes it unreliable. We need to filter it out. Sorry about that!

It might help if you make a larger time range in the timepicker, like last hour.

-Tim

---

<div class="post-metadata">

**Author:** ![\_Ian](https://avatars.discourse-cdn.com/v4/letter/_/ccd318/32.png) [@\_Ian](https://discuss.elastic.co/u/_Ian)\
**Post date:** [April 27, 2017, 2:17pm UTC](https://discuss.elastic.co/t/draw-error-on-logstash-graphs-skewing-scale/83708/4 "2017-04-27T14:17:06Z")

</div>

Hi Tim,  
That's good to know and makes sense. I have noticed larger time frames are less prone to the render error. While doing pipeline troubleshooting it is often the most recent time window (~15 minutes) which is most useful to look for changes in throughput. That's why it is more annoying while the larger time frame windows may not be as buggy. It would be nice if the metric assumed a 0 rather than a large value when the partial information causes unreliability. This would have less impact on the graph scale, I'd think?

Lee,  
I'm actually not concerned about the gap. Logstash was simply stopped during this time as this cluster is currently in development.

Thanks guys.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 25, 2017, 2:31pm UTC](https://discuss.elastic.co/t/draw-error-on-logstash-graphs-skewing-scale/83708/5 "2017-05-25T14:31:04Z")

</div>

Closed on May 25, 2017, 2:31pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
