Network I/O Timelion show crazy with offset one second

Elastic Stack Kibana
1

I got the followed graphic:

19
192428×702 59.8 KB

From the data:

30
301804×720 84.9 KB

Query:

.es(kibana=true, index=metricbeat-*, timefield=@timestamp,
metric='sum:system.network.out.bytes', q='system.network.name:eth0')
.mvavg(1m)
.derivative()
.scale_interval(1s)
.if(operator=lt, if=0, then=0)
.multiply(8)
.lines(width=2)
.color(#508ef2)
.label(out)
.yaxis(units=bits/s)
.legend(columns=2, position=ne)

Ps. formated code for view

It seems because the metricbeat got the data delayed ONE secend.

And then, try the 2 mins interval:

04
042448×706 65.3 KB

The problem is same, but only the maximum is average. I had change the mvavg(2m).

I think it maybe a zero data problem. but after I set the interval to one second for recently. It look better.

37
372434×724 61.5 KB

How could I resolve this problem?

Is a way to filter the data over a error thresholds?

Thanks for any information.

2

Sorry, but it is not very clear what your question is.

In the first 2 charts, there is a spike that seems to make the other data with lower values not visible.

You can set a limit on the data bounds in the q parameter of the .es function, with something like:

q='system.network.name:eth0 AND system.network.out.bytes:[0 TO 1000000]'

To me, it looks like that chart is showing more consistent data because the time frame is "Last 15 minutes" instead of "Last 4 hours"

3

Hi, @tsullivan

Thank for your answer.
It isn't a data problem, it's a collection time problem.
We write some script for this, and it has been solved. :smiley: