Timelion gaps in dashboard display data (SNMP interface utilization)

Hello,

Recently I have made my first logstash pipeline that ingests data gathered via SNMP form network devices regarding interfaces statistic. I have made timelion graph to displayed network interface utilization but I notice that from time to time I am shown a dashboard with "missing" data. I don't really know how to debug this to please advise how I can show all data with no gaps..

My script looks like this

.es(index=network-devices*,
    timefield=@timestamp,
    metric=max:cisco.device.system.interface.ifInOctets,split=cisco.device.system.interface.ifName.keyword:150)
  .derivative().divide(.es(index=network-devices*,
    timefield=@timestamp,
    metric=max:cisco.device.system.interface.ifSpeed)).multiply(100)
    .label("[$1] IN", "^.* > cisco.device.system.interface.ifName.keyword:(\S+) > .*")
        .if(lt,0.001,null)
        ,
.es(index=network-devices*,
    timefield=@timestamp,
    metric=max:cisco.device.system.interface.ifOutOctets,split=cisco.device.system.interface.ifName.keyword:150)
  .derivative().divide(.es(index=network-devices*,
    timefield=@timestamp,
    metric=max:cisco.device.system.interface.ifSpeed))
    .multiply(100).label("[$1] OUT", "^.* > cisco.device.system.interface.ifName.keyword:(\S+) > .*")
    .if(lt,0.001,null)

If I get rid of " .if(lt,0.001, null)" this is how the dashboard looks like.

image

While writing this post I realize that this happens because counters continuously restart after some period of time. This is because I used 32 bit counter and should 64bit, anyway this problem with occur but less often. I imagine that some resolution would be an if statement that says if the value is negative I should add the current value to the next value and then take the derivative and other calculation and offset everything +1 forward. Or something like this. Does anyone have any idea how to deal with this?

I was thinking about that and I figured that since this filed max value is 2 exp 64 = 18,446,744,073,709,551,616 (about 18.4 quintillion) whenever I got negative value from my derivative that means I need to add 2 exp 64 to first value and then apply derivative. How can I implement this?

I figured out that I can use logstash output plugin to save the last event to file and input plugin to read them with every new event and get my data in this way.

It sounds like you've solved your own problem, but there is also a fitting function option in timelion that lets you fill gaps in the data.

How is It called? I will check that.

It is .fit(mode=average)

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.