Timelion count rate per second

[dwjvaughan]

I'm struggling to find the rate that a certain strings appears per second. So far I have this:

.es(index=myindex-*, q='@message: "specific string"').scale_interval(1s)

When I zoom in I can see it does split it out by second (and seems accurate) but zooming out I think it gives me the average for that interval. Ideally, I want to show the max rate per second (for that interval) - I'm not sure if this is possible however.

Any help appreciated!

Cheers,
Dave

[Joe_Fleming]

The reason the data is scaling as you zoom is likely because you have the scaling set to auto (the select box above the play button on the top right). The underlying data in visualizations can only be so dense and still be drawn correctly. There's a limit of 2000 points, so while you can force it to use more points instead of rolling up the values across times, but you'll get an error saying you have too many points to render the vis.

[dwjvaughan]

Thanks for the response. I had tried setting to 1s and increased the bucket limit too. I guess there's no way to grab the max rate per second in the auto timeframe then? For example: The max rate/sec for the whole hour, for each hour of the day.

Thinking about it logically, I don't believe its possible as it would still need to check the rate per second, for each second, thus using lots of buckets. I'd probably have to write some kind of round up job to calculate this on a per minute basis and write this to a new index and search over that instead.

Thanks for your help.
Dave