Thanks for the reply Ben. This is exactly what I have already been looking at, which is encouraging!
I have initially been testing with just two servers, trying to monitor the upload speeds. So I have the detector set to mean upload, and partition field set to host.hostname.keyword. I am getting results in the graph, but one thing that makes me think it's not quite working correctly, is in the host.hostname.keyword drop down menu highlighted in the screenshot, I only see 1 hostname, but below it says "Single time series analysis of avg upload (2 distinct host.hostname.keyword values)". I would have expected to see both hostnames of servers that are feeding their results in?
