Network I/O Timelion show crazy with offset one second

[RomainXie]

I got the followed graphic:

From the data:

Query:

.es(kibana=true, index=metricbeat-*, timefield=@timestamp,
metric='sum:system.network.out.bytes', q='system.network.name:eth0')
.mvavg(1m)
.derivative()
.scale_interval(1s)
.if(operator=lt, if=0, then=0)
.multiply(8)
.lines(width=2)
.color(#508ef2)
.label(out)
.yaxis(units=bits/s)
.legend(columns=2, position=ne)

Ps. formated code for view

It seems because the metricbeat got the data delayed ONE secend.

And then, try the 2 mins interval:

The problem is same, but only the maximum is average. I had change the mvavg(2m).

I think it maybe a zero data problem. but after I set the interval to one second for recently. It look better.

How could I resolve this problem?

Is a way to filter the data over a error thresholds?

Thanks for any information.

[tsullivan (Tim Sullivan)]

Sorry, but it is not very clear what your question is.

In the first 2 charts, there is a spike that seems to make the other data with lower values not visible.

You can set a limit on the data bounds in the q parameter of the .es function, with something like:

q='system.network.name:eth0 AND system.network.out.bytes:[0 TO 1000000]'

@RomainXie

I think it maybe a zero data problem. but after I set the interval to one second for recently. It look better.

To me, it looks like that chart is showing more consistent data because the time frame is "Last 15 minutes" instead of "Last 4 hours"

[RomainXie]

Hi, @tsullivan

Thank for your answer.
It isn't a data problem, it's a collection time problem.
We write some script for this, and it has been solved.