# Metricbeat to show network packets over time

**URL:** <https://discuss.elastic.co/t/metricbeat-to-show-network-packets-over-time/149709>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [September 24, 2018, 4:27pm UTC](https://discuss.elastic.co/t/metricbeat-to-show-network-packets-over-time/149709 "2018-09-24T16:27:27Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Drav3nmc](https://avatars.discourse-cdn.com/v4/letter/d/e19adc/32.png) [@Drav3nmc](https://discuss.elastic.co/u/Drav3nmc)\
**Post date:** [September 24, 2018, 4:27pm UTC](https://discuss.elastic.co/t/metricbeat-to-show-network-packets-over-time/149709/1 "2018-09-24T16:27:28Z")

</div>

I have metricbeats running on windows server and would like to see a graph of the network traffic over time, to see if i am maxing out network card.

I can see the network metricset.name and the system.network.in.bytes and system.network.out.bytes, but these metrics seem to be accumuliative values so would want need to do a sum of current value minus last value to get current bytes in / out. Unless you clever people know of a better way to do this.

Thanks in advance  
Mark

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [September 25, 2018, 6:37am UTC](https://discuss.elastic.co/t/metricbeat-to-show-network-packets-over-time/149709/2 "2018-09-25T06:37:24Z")

</div>

As the value is a counter you have to take the derivative to show the recent changes: [https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-derivative-aggregation.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-derivative-aggregation.html)

---

<div class="post-metadata">

**Author:** ![Drav3nmc](https://avatars.discourse-cdn.com/v4/letter/d/e19adc/32.png) [@Drav3nmc](https://discuss.elastic.co/u/Drav3nmc)\
**Post date:** [September 25, 2018, 7:54am UTC](https://discuss.elastic.co/t/metricbeat-to-show-network-packets-over-time/149709/3 "2018-09-25T07:54:00Z")

</div>

Thanks ruflin,  
I think I understand the document, but wonder how do i implement that into my environment  
Sorry if this is obvious

---

<div class="post-metadata">

**Author:** ![Drav3nmc](https://avatars.discourse-cdn.com/v4/letter/d/e19adc/32.png) [@Drav3nmc](https://discuss.elastic.co/u/Drav3nmc)\
**Post date:** [September 25, 2018, 3:04pm UTC](https://discuss.elastic.co/t/metricbeat-to-show-network-packets-over-time/149709/4 "2018-09-25T15:04:17Z")

</div>

I have found this and it answers what i want to acheive

> [@Kibana visualize network bandwidth from metribeat](https://discuss.elastic.co/t/kibana-visualize-network-bandwidth-from-metribeat/84698/4):
>
> You will probably have more success using Timelion in this case. .es(index="metricbeat-\*", metric="max:system.network.in.bytes", split="system.network.name:10", kibana=true).derivative().scale\_interval(1s).if(operator="lt", if=0, then=0).trim(start=2,end=1).label(regex="^.\* system.network.name:(.+) \> .\*$", label="$1").lines(width=2).yaxis(label="bytes / sec", min=0) Lets break this down a bit... .es( index="metricbeat-\*", metric="max:system.network.in.bytes", split="system.network.name:…

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 23, 2018, 3:13pm UTC](https://discuss.elastic.co/t/metricbeat-to-show-network-packets-over-time/149709/6 "2018-10-23T15:13:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.