Hello, everyone!
Not so long ago i decided to try elastic agent+system integration instead of metricbeat with system module (which i have used for a very long time). the problem i faced is i can't make SOME graphs in grafana using new sourse (elastic agent). the only difference i noticed is that metricbeat creates index with "system.network.in.bytes" field as "Number" type, which can be succesfully used with grafana "script" option on a query tab. and elastic agent creates the same field "system.network.in.bytes" as "Counter metric" type
so...when i try to make a graph to count network megabits/second, the only way i know is to make it in two steps: count average, count derivative after that
then i make some math on those numbers to transform bytes into megabits
i use this formula in "script" tab within a query:
(_value * 8 )/ ($__interval_ms / 1000) and it works with metricbeat source
but when i add this formula to a new source, it immediately breaks a query
the only assumption i have is this difference in fields types
can you please answer at least one of my questions:
- is there a way to make this math on current fields (elastic agent+system integration source)
- is there an another way to count megabits/second on graph instead of my math? keep in mind that i use the same principles to count many metrics, so your suggetion have to work universally, not exactly here, with system.network integration
- can i make needed math previously, on elastic index level? to have pre-prepared variable that i can use in grafana directly, not using any math on it's level
- can i make some changes (and which) to transform fields types in elastic agent source to make them the same as in metricbeat source? and will these manipulations be a correct way to use indices?