I'm not succeeding displaying correctly in kibana line or area visualization of real-time data coming from metricbeat munin plugin.
The events at elasticsearch are essentially number type reads of listeners on a couple streaming servers (real-time server stats, not a log line analysis). While munin graphs that data correctly (munin executes its plugins every 5 minutes and updates graph adding a new y-axis point/value result from executed plugin at a given x-axis time) I cannot do the same in kibana.
I'm having the data reads correctly in EL... I'm failing at the final step!
Setting metricbeat to read munin plugins every 5 minutes aleviated the problem, which is that I'm getting buckets at X-axis with too many reads sum, giving too high, wrong real-time values.
I can do, but, a metric or gauge visualization that reads current real-time value very accurately: I just need to sum reads of the last 5 minutes! but, on line or area visualizations i'm lost... buckets go beyond 5 minutes in span quickly, so, depending on the situation I can get figures with twice the real actual values (and I'm forced to slow down munin at metricbeat at 300s interval to at least go to something of this world)
Note but that I indeed need to sum... because number events come from a couple of servers, so I cannot do an average... I'm lost with this...
How is the right way to do this? I know that I can't tell kibana to stick to 5 minute buckets (too many buckets problem soon or later) ... but could I tell her to somehow average 5 minute neighboring buckets? or drop interleaving buckets? someway to prevent it to sum values from consecutive reads?...
Hope some experienced kibana user could help.
Thank you very much in advance anyways.