Plot cum sum metric


I recently setup metricbeat to monitor various metrics over various hosts and I find it very tricky to plot metrics that come in a cumulative sum form like network bytes in any of the visualization options.

I can use a derivative or a serial diff aggregation to plot the change of the metric but when these metrics' cum sum resets I get a negative value in the aggregation result. I can avoid plotting the negative value with:

  • Setting the axis' min value to 0 on standard visualisations
  • Using positive only on TSVB
  • Using an if on timelion

but I still get a zero in these cases and combining for example lots of hosts' network traffics in a plot the zero adds a ton of noise to the graph. Is there any other trick to avoid this?

I was thinking maybe I could calculate the rate value in logstash and drop negative values results there. Any pointers on how to do this maybe or any other solution?

You already mentioned pretty much all of the options you are having :slight_smile:

You could of course calculate this pre-indexing and using logstash or any other solution.

If you want to stick with the data you are having, and you are just annoyed by the noise of all the 0 values, you could use timelion's if and instead of setting it to 0 setting it to null. That way that point should vanish from the graph altogether.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.