Newbie question: Timelion metric/split

Elastic Stack Kibana
1

Hi,

I'm new to Kibana and i'am struggling on a -maybe- simple thing.

I have this Timelion graph' :

.**es(index="netflow-*", metric="sum:netflow.bytes", split="netflow.src_port_name:10", kibana=true)**.scale_interval(1s).fit(mode=scale).if(operator="lt", if=0, then=0).trim(start=2,end=1).label(regex="^.* netflow.src_port_name:(.+) > .*$", label="$1").lines(width=1, stack=true, fill=10, steps=true).yaxis(label="bytes / sec", min=0)

This show me a graph' of my Netflow informations. It aggregates on netflow.bytes and split on src_port_name:10, keeping only the top 10.

The problem is that in my top 10 i have the 10 protocols that "appears" the most in the index, but i would like the top 10 protocols in terms of Bytes (so after the aggregation).

It means that if i do a single connection on an unusual port with a LOT of trafic (Bytes), it will only generate a single flow (= log line) and i won't appear on the top 10. On the other hands, protocols that are doing a lot of flows (eg DNS) but very few Bytes will appear in the top 10.

If someone understand the issue, i would like to get advices to have the correct behavior :slight_smile:

Thank you

2

Hi, this is about having the buckets of a terms aggregation sorted by a metric sub-aggtregation instead of the doc_count of the bucket. Unfortunately, Timelion does not support this at the moment.

However, the Time Series Visual Builder visualization can do this. Note how I'm able to order by "Sum of metric":

image
image.png1261×616 48.2 KB

BTW TSVB just uses aggregation features of Elasticsearch to do this. A raw Elasticsearch query for data ordered like this looks like:

POST /metrics/_search
{
  "aggs": {
    "cats": {
      "terms": {
        "field": "cat",
        "size": 10,
        "order": {
          "metric_sum": "desc"
        }
      },
      "aggs": {
        "metric_sum": {
          "sum": {
            "field": "metric"
          }
        }
      }
    }
  }
}
3

Hi,

Thank you for your reply.

It's sad that Timelion doesn't support it, it looks quite simple.. Hope it'll be supported in the future.

Your solution looks promising, now i have the right Top 10 with TSVB!

But i still have a problem : "sum:netflow.bytes" just compute the total of bytes per protocols. After that, i would like to get the bytes**/seconds**. Since my interval is 1minute, i must divide the values by 60.
In Timelion, this is done by .scale_interval(1s), but i don't find the equivalent in TSVB.

I would also like to transform those Bytes/sec into Bits/sec.

Is there a way to do this in TSVB? I tried Custom Data Formatter with Numeral.js operation like .divide() but it doesn't seems to work.

Thanks a lot!!! :slight_smile:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.