# Time series of various processing numbers

**URL:** <https://discuss.elastic.co/t/time-series-of-various-processing-numbers/195069>\
**Category:** Elasticsearch\
**Created:** [August 13, 2019, 5:29pm UTC](https://discuss.elastic.co/t/time-series-of-various-processing-numbers/195069 "2019-08-13T17:29:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![JGT](https://avatars.discourse-cdn.com/v4/letter/j/58956e/32.png) [@JGT](https://discuss.elastic.co/u/JGT)\
**Post date:** [August 13, 2019, 5:29pm UTC](https://discuss.elastic.co/t/time-series-of-various-processing-numbers/195069/1 "2019-08-13T17:29:45Z")

</div>

I have several logs that have periodic messages with performance data. I want to graph the metrics over time. Things like number of users logged in, virtual memory used, pages in and out, etc.

Each record/message has a date and time stamp, which I have been able to set as the timefield. Then I have a collection of fields. Most are integer values, some are float and the rest are string.

I have not been able to figure out what type of aggregation I need to set on the values.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [August 14, 2019, 7:57am UTC](https://discuss.elastic.co/t/time-series-of-various-processing-numbers/195069/2 "2019-08-14T07:57:53Z")

</div>

hey,

as you have not mentioned what result you are expecting it is hard to help in this case. Maybe just take the time to explain the data format of a single document, and the expectation of a result for one field, like number\_of\_users\_logged\_in.

What result to you expect when there are more documents in a single bucket? An avg? max/min? etc...

without those expectations it will be super hard to help.

--Alex

---

<div class="post-metadata">

**Author:** ![JGT](https://avatars.discourse-cdn.com/v4/letter/j/58956e/32.png) [@JGT](https://discuss.elastic.co/u/JGT)\
**Post date:** [August 14, 2019, 12:40pm UTC](https://discuss.elastic.co/t/time-series-of-various-processing-numbers/195069/3 "2019-08-14T12:40:46Z")

</div>

Alex,

Thank you for your reply!

A record from this log file has a common header, including a timestamp that I capture, and then different content for the process producing the record. I am currently working with a record type that looks like the following.

SYSINFO:Application=GROUP; PID=424; NumUsers=2; CPU(Cores)=10; NumTasks=1; NumErrors=0; PhysicalMem=34359201792; UsedPhysicalMem=8577638400; ProcUsedPhysicalMem=6175686656; VirtualMem=140737488224256; UsedVirtualMem=8384761856; ProcUsedVirtualMem=6286733312; UsedCPU=6.12255; ProcUsedCPU=5.16628; NumCubesInRAM=280; NumDataRecordsInRAM=4824935; NumRecordsInLargestCube=172758

I have a grok filter that put all of those fields in a group based on the record type. I use grok so that I can type the fields integer instead of doing a separate mutate{}. I end up with the following.

Data2.UsedVirtualMem = 8384761856  
Data2.NumUsers = 2  
etc.

What I want to get is a line chart with date and time on the X axis and then the various fields on the Y. Give the wide range, I would use one side for the large memory number and the side for the smaller values like users, tasks and such.

I don't want to aggregate the values, I want to graph them.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 11, 2019, 12:40pm UTC](https://discuss.elastic.co/t/time-series-of-various-processing-numbers/195069/4 "2019-09-11T12:40:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.