# Kibana visualize network bandwidth from metribeat

**URL:** <https://discuss.elastic.co/t/kibana-visualize-network-bandwidth-from-metribeat/84698>\
**Category:** Kibana\
**Created:** [May 5, 2017, 10:46am UTC](https://discuss.elastic.co/t/kibana-visualize-network-bandwidth-from-metribeat/84698 "2017-05-05T10:46:58Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![revolucio](https://avatars.discourse-cdn.com/v4/letter/r/b77776/32.png) [@revolucio](https://discuss.elastic.co/u/revolucio)\
**Post date:** [May 5, 2017, 10:46am UTC](https://discuss.elastic.co/t/kibana-visualize-network-bandwidth-from-metribeat/84698/1 "2017-05-05T10:46:58Z")

</div>

Hi all,

I'm trying to generate a network bandwidth visualization using Kibana 5.4.0

Now thanks to the derivative metric seems really easy so I did :

 ![](https://us1.discourse-cdn.com/elastic/original/3X/7/5/75e078eae85c2f9849f711b54e3b0a37c4c5bb45.PNG)

It works pretty well but from time to time I have a negative peak on the grapsh that really makes hard to understand what happen on the traffic:

 ![](https://us1.discourse-cdn.com/elastic/original/3X/e/8/e8588c7e5d13bc635acf95e6015b6d520511f0b7.PNG)

So I'm almost crazy trying to find a solution.

The first idea is to only show positive data, but I have no idea how to do it.

Any idea on this will be more than welcome.

Thanks.

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [May 5, 2017, 3:59pm UTC](https://discuss.elastic.co/t/kibana-visualize-network-bandwidth-from-metribeat/84698/2 "2017-05-05T15:59:51Z")

</div>

`system.network.in.bytes` is a cumulative field, so you probably don't want to be `sum`ming it (since it already contains a sum). Instead try taking a `max` of it.

---

<div class="post-metadata">

**Author:** ![revolucio](https://avatars.discourse-cdn.com/v4/letter/r/b77776/32.png) [@revolucio](https://discuss.elastic.co/u/revolucio)\
**Post date:** [May 10, 2017, 11:08am UTC](https://discuss.elastic.co/t/kibana-visualize-network-bandwidth-from-metribeat/84698/3 "2017-05-10T11:08:00Z")

</div>

Thanks a lot for the hint....

Max doesn't seem to solve the problem for me.

I will try to generate a new field that will be always positive for this.

Bests

---

<div class="post-metadata">

**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\
**Post date:** [May 19, 2017, 6:33pm UTC](https://discuss.elastic.co/t/kibana-visualize-network-bandwidth-from-metribeat/84698/4 "2017-05-19T18:33:43Z")

</div>

You will probably have more success using Timelion in this case.

```
.es(index="metricbeat-*", metric="max:system.network.in.bytes", split="system.network.name:10", kibana=true).derivative().scale_interval(1s).if(operator="lt", if=0, then=0).trim(start=2,end=1).label(regex="^.* system.network.name:(.+) > .*$", label="$1").lines(width=2).yaxis(label="bytes / sec", min=0)

```

Lets break this down a bit...

```
.es(
  index="metricbeat-*",
  metric="max:system.network.in.bytes",
  split="system.network.name:10",
  kibana=true
)

```

Query the `metricbeat-*` index in Elasticsearch for the field `system.network.in.bytes`, returning values for up to 10 instances of interface names ( `split="system.network.name:10"` ). The chart should also apply Kibana timescales and filters ( `kibana=true` ).

`.derivative()`  
Since the value is a counter we need the delta between successive buckets.

`.scale_interval(1s)`  
We want the value expressed as the number of bytes per second.

`.if(operator="lt", if=0, then=0)`  
If the value is less than zero, such as when the counter wraps, use zero instead. This will fix your negative spike issue.

`.trim(start=2,end=1)`  
By removing the first two and last values we can remove a visual artifact that can occur due to partial time buckets at the beginning and end of the chart.

`.label(regex="^.* system.network.name:(.+) > .*$", label="$1")`  
Extract the interface name from the auto-generated label and use that in the legend.

`.lines(width=2)`  
I like a thinner line than the default, especially when displaying multiple interfaces on the same chart.

`.yaxis(label="bytes / sec", min=0)``  
Finally, add a label to the y-axis to display the indicated units.

The resulting chart will be similar to this... (this config is a little different than above)

 ![](https://us1.discourse-cdn.com/elastic/original/3X/5/0/50c2e311162506a9facdc3888a5994378caf672e.png)

Rob

---

<div class="post-metadata">

**Author:** ![revolucio](https://avatars.discourse-cdn.com/v4/letter/r/b77776/32.png) [@revolucio](https://discuss.elastic.co/u/revolucio)\
**Post date:** [May 22, 2017, 9:35am UTC](https://discuss.elastic.co/t/kibana-visualize-network-bandwidth-from-metribeat/84698/5 "2017-05-22T09:35:17Z")

</div>

Hi Robert,

I have no words for your reply, really useful and well explained.

I see that my original idea of draw this graph in a line visualisation is not as easy as it seems to me at the beginning.

Thank you, thank you very much....

---

<div class="post-metadata">

**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\
**Post date:** [May 24, 2017, 2:42am UTC](https://discuss.elastic.co/t/kibana-visualize-network-bandwidth-from-metribeat/84698/6 "2017-05-24T02:42:13Z")

</div>

The new time series was touted as being able to make this easy but I'm running into the same issues as you. Derivatives produce incorrect results. How you can make a negative graph out of values that are always 0 or higher is beyond me.

In timelion I did it like this. Note that the mvavg requires a additional plugin. I needed this to smooth out my results for my netflow. Might not me necessary using metricbeat depending on how the data is collected.

$src\_query='host:1.1.1.1, .es($src\_query,metric='sum:netflow.in\_bytes').mvavg(1m).scale\_interval(1s).divide(1024).label('Up - KBps')

I made different queries for dst, total and also some separate subnets (host:1.1.1.1 AND src\_add: 192.168.1.\*) so I have 5 or 6 lines in one graph.

edit: scale.interval causes problems when you try to view data over a long period of time because it will create too many buckets. Use the mvavg mod instead.

---

<div class="post-metadata">

**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\
**Post date:** [May 24, 2017, 5:56am UTC](https://discuss.elastic.co/t/kibana-visualize-network-bandwidth-from-metribeat/84698/7 "2017-05-24T05:56:37Z")

</div>

@Sjaak01, I was about to reply to your related post with a link to what I posted here, but noticed that you found it already. I will also try out mvavg() myself. Thanks for the tip.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 21, 2017, 5:56am UTC](https://discuss.elastic.co/t/kibana-visualize-network-bandwidth-from-metribeat/84698/8 "2017-06-21T05:56:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.