You will probably have more success using Timelion in this case.
.es(index="metricbeat-*", metric="max:system.network.in.bytes", split="system.network.name:10", kibana=true).derivative().scale_interval(1s).if(operator="lt", if=0, then=0).trim(start=2,end=1).label(regex="^.* system.network.name:(.+) > .*$", label="$1").lines(width=2).yaxis(label="bytes / sec", min=0)
Lets break this down a bit...
.es(
index="metricbeat-*",
metric="max:system.network.in.bytes",
split="system.network.name:10",
kibana=true
)
Query the metricbeat-* index in Elasticsearch for the field system.network.in.bytes, returning values for up to 10 instances of interface names ( split="system.network.name:10" ). The chart should also apply Kibana timescales and filters ( kibana=true ).
.derivative()
Since the value is a counter we need the delta between successive buckets.
.scale_interval(1s)
We want the value expressed as the number of bytes per second.
.if(operator="lt", if=0, then=0)
If the value is less than zero, such as when the counter wraps, use zero instead. This will fix your negative spike issue.
.trim(start=2,end=1)
By removing the first two and last values we can remove a visual artifact that can occur due to partial time buckets at the beginning and end of the chart.
.label(regex="^.* system.network.name:(.+) > .*$", label="$1")
Extract the interface name from the auto-generated label and use that in the legend.
.lines(width=2)
I like a thinner line than the default, especially when displaying multiple interfaces on the same chart.
`.yaxis(label="bytes / sec", min=0)``
Finally, add a label to the y-axis to display the indicated units.
The resulting chart will be similar to this... (this config is a little different than above)
Rob