Metricbeat - system network - how does it work?

Elastic Stack Beats
#1

Hi, In the background of metricbeat once I configure it to collect system.network metrics
with period of 15 minutes, what does it do?
More specificaly what is exactly the value mentioned in system.network.out.bytes/system.network.in.bytes?
Is it the amount of traffic captured in a given time? in a period of 15m between samples?
does metricbeat constantly sample the network device or rather only on the activated periods mentioned in the configurations?

Thanks,
Nitzan Karni

#2

Both system.network.in.bytes and system.network.out.bytes are counter fields, that is, they contain the cumulative values of bytes transferred in and out, respectively, over time. So, generally speaking, each time these metrics are collected by the system/network metricset from the underlying system, their values will have increased (assuming there's some network activity).

The 15m period just refers to how often these (and other) metrics should be collected by the system module from the underlying system.

Hope that helps,

Shaunak