# Metricbeat - system network - how does it work?

**URL:** <https://discuss.elastic.co/t/metricbeat-system-network-how-does-it-work/248507>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [September 14, 2020, 10:26am UTC](https://discuss.elastic.co/t/metricbeat-system-network-how-does-it-work/248507 "2020-09-14T10:26:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nitzan.karni](https://avatars.discourse-cdn.com/v4/letter/n/c57346/32.png) [@nitzan.karni](https://discuss.elastic.co/u/nitzan.karni)\
**Post date:** [September 14, 2020, 10:26am UTC](https://discuss.elastic.co/t/metricbeat-system-network-how-does-it-work/248507/1 "2020-09-14T10:26:27Z")

</div>

Hi, In the background of metricbeat once I configure it to collect system.network metrics  
with period of 15 minutes, what does it do?  
More specificaly what is exactly the value mentioned in system.network.out.bytes/system.network.in.bytes?  
Is it the amount of traffic captured in a given time? in a period of 15m between samples?  
does metricbeat constantly sample the network device or rather only on the activated periods mentioned in the configurations?

Thanks,  
Nitzan Karni

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [September 14, 2020, 8:46pm UTC](https://discuss.elastic.co/t/metricbeat-system-network-how-does-it-work/248507/2 "2020-09-14T20:46:02Z")

</div>

Both `system.network.in.bytes` and `system.network.out.bytes` are counter fields, that is, they contain the **cumulative** values of bytes transferred in and out, respectively, over time. So, generally speaking, each time these metrics are [collected by the `system/network` metricset](https://github.com/elastic/beats/blob/a0f804163ae44b215df94c2abbd1844dd466951a/metricbeat/module/system/network/network.go#L77) from the underlying system, their values will have increased (assuming there's some network activity).

The `15m` period just refers to how often these (and other) metrics should be collected by the `system` module from the underlying system.

Hope that helps,

Shaunak

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 12, 2020, 10:46pm UTC](https://discuss.elastic.co/t/metricbeat-system-network-how-does-it-work/248507/3 "2020-10-12T22:46:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.