# Kibana visualize network bandwidth from metribeat

**URL:** <https://discuss.elastic.co/t/kibana-visualize-network-bandwidth-from-metribeat/84698>\
**Category:** Kibana\
**Created:** [May 5, 2017, 10:46am UTC](https://discuss.elastic.co/t/kibana-visualize-network-bandwidth-from-metribeat/84698 "2017-05-05T10:46:58Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\
**Post date:** [May 19, 2017, 6:33pm UTC](https://discuss.elastic.co/t/kibana-visualize-network-bandwidth-from-metribeat/84698/4 "2017-05-19T18:33:43Z")

</div>

You will probably have more success using Timelion in this case.

```
.es(index="metricbeat-*", metric="max:system.network.in.bytes", split="system.network.name:10", kibana=true).derivative().scale_interval(1s).if(operator="lt", if=0, then=0).trim(start=2,end=1).label(regex="^.* system.network.name:(.+) > .*$", label="$1").lines(width=2).yaxis(label="bytes / sec", min=0)

```

Lets break this down a bit...

```
.es(
  index="metricbeat-*",
  metric="max:system.network.in.bytes",
  split="system.network.name:10",
  kibana=true
)

```

Query the `metricbeat-*` index in Elasticsearch for the field `system.network.in.bytes`, returning values for up to 10 instances of interface names ( `split="system.network.name:10"` ). The chart should also apply Kibana timescales and filters ( `kibana=true` ).

`.derivative()`  
Since the value is a counter we need the delta between successive buckets.

`.scale_interval(1s)`  
We want the value expressed as the number of bytes per second.

`.if(operator="lt", if=0, then=0)`  
If the value is less than zero, such as when the counter wraps, use zero instead. This will fix your negative spike issue.

`.trim(start=2,end=1)`  
By removing the first two and last values we can remove a visual artifact that can occur due to partial time buckets at the beginning and end of the chart.

`.label(regex="^.* system.network.name:(.+) > .*$", label="$1")`  
Extract the interface name from the auto-generated label and use that in the legend.

`.lines(width=2)`  
I like a thinner line than the default, especially when displaying multiple interfaces on the same chart.

`.yaxis(label="bytes / sec", min=0)``  
Finally, add a label to the y-axis to display the indicated units.

The resulting chart will be similar to this... (this config is a little different than above)

 ![](https://us1.discourse-cdn.com/elastic/original/3X/5/0/50c2e311162506a9facdc3888a5994378caf672e.png)

Rob

---

_[View the full topic](https://discuss.elastic.co/t/kibana-visualize-network-bandwidth-from-metribeat/84698)._