# Timeline - how constract network I/O graph

**URL:** <https://discuss.elastic.co/t/timeline-how-constract-network-i-o-graph/120126>\
**Category:** Kibana\
**Created:** [February 16, 2018, 9:01am UTC](https://discuss.elastic.co/t/timeline-how-constract-network-i-o-graph/120126 "2018-02-16T09:01:19Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nikita\_Krasnov](https://avatars.discourse-cdn.com/v4/letter/n/53a042/32.png) [@Nikita\_Krasnov](https://discuss.elastic.co/u/Nikita_Krasnov)\
**Post date:** [February 16, 2018, 9:01am UTC](https://discuss.elastic.co/t/timeline-how-constract-network-i-o-graph/120126/1 "2018-02-16T09:01:19Z")

</div>

I use MetricBeat 6.1.3 and Kibana and want to constract graph that will show I/O network trafic for each server.  
As I understood I have to use `derivate()` fucnction for this. But how I can split this trafic for each server?  
Here the example for input trafic but without splitting: `.es(index=metricbeat-6.1.3-*, timefield=@timestamp, metric=avg:system.network.out.bytes).derivative()`

---

<div class="post-metadata">

**Author:** ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)\
**Post date:** [February 16, 2018, 5:53pm UTC](https://discuss.elastic.co/t/timeline-how-constract-network-i-o-graph/120126/2 "2018-02-16T17:53:25Z")

</div>

You'll want to add `split` to your first function, like this:

`.es(index=metricbeat-6.1.3-*, split=server.hostname:10, ...`

---

<div class="post-metadata">

**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\
**Post date:** [February 17, 2018, 7:36am UTC](https://discuss.elastic.co/t/timeline-how-constract-network-i-o-graph/120126/3 "2018-02-17T07:36:47Z")

</div>

Take a look at this reply...

> [@Kibana visualize network bandwidth from metribeat](https://discuss.elastic.co/t/kibana-visualize-network-bandwidth-from-metribeat/84698/4):
>
> You will probably have more success using Timelion in this case. .es(index="metricbeat-\*", metric="max:system.network.in.bytes", split="system.network.name:10", kibana=true).derivative().scale\_interval(1s).if(operator="lt", if=0, then=0).trim(start=2,end=1).label(regex="^.\* system.network.name:(.+) \> .\*$", label="$1").lines(width=2).yaxis(label="bytes / sec", min=0) Lets break this down a bit... .es( index="metricbeat-\*", metric="max:system.network.in.bytes", split="system.network.name:…

It is still pretty to what I typically use today, and should help in figuring out the various options.

---

<div class="post-metadata">

**Author:** ![Nikita\_Krasnov](https://avatars.discourse-cdn.com/v4/letter/n/53a042/32.png) [@Nikita\_Krasnov](https://discuss.elastic.co/u/Nikita_Krasnov)\
**Post date:** [February 19, 2018, 9:39am UTC](https://discuss.elastic.co/t/timeline-how-constract-network-i-o-graph/120126/4 "2018-02-19T09:39:44Z")

</div>

Thanks a lot. Are such negative values isn't useful for you?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 19, 2018, 9:39am UTC](https://discuss.elastic.co/t/timeline-how-constract-network-i-o-graph/120126/5 "2018-03-19T09:39:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.