Timelion gaps in dashboard display data (SNMP interface utilization)

Elastic Stack Kibana
1

Hello,

Recently I have made my first logstash pipeline that ingests data gathered via SNMP form network devices regarding interfaces statistic. I have made timelion graph to displayed network interface utilization but I notice that from time to time I am shown a dashboard with "missing" data. I don't really know how to debug this to please advise how I can show all data with no gaps..

image
image1891×702 60.5 KB

My script looks like this

.es(index=network-devices*,
    timefield=@timestamp,
    metric=max:cisco.device.system.interface.ifInOctets,split=cisco.device.system.interface.ifName.keyword:150)
  .derivative().divide(.es(index=network-devices*,
    timefield=@timestamp,
    metric=max:cisco.device.system.interface.ifSpeed)).multiply(100)
    .label("[$1] IN", "^.* > cisco.device.system.interface.ifName.keyword:(\S+) > .*")
        .if(lt,0.001,null)
        ,
.es(index=network-devices*,
    timefield=@timestamp,
    metric=max:cisco.device.system.interface.ifOutOctets,split=cisco.device.system.interface.ifName.keyword:150)
  .derivative().divide(.es(index=network-devices*,
    timefield=@timestamp,
    metric=max:cisco.device.system.interface.ifSpeed))
    .multiply(100).label("[$1] OUT", "^.* > cisco.device.system.interface.ifName.keyword:(\S+) > .*")
    .if(lt,0.001,null)

If I get rid of " .if(lt,0.001, null)" this is how the dashboard looks like.

image

image
image455×837 15.7 KB

While writing this post I realize that this happens because counters continuously restart after some period of time. This is because I used 32 bit counter and should 64bit, anyway this problem with occur but less often. I imagine that some resolution would be an if statement that says if the value is negative I should add the current value to the next value and then take the derivative and other calculation and offset everything +1 forward. Or something like this. Does anyone have any idea how to deal with this?

2

I was thinking about that and I figured that since this filed max value is 2 exp 64 = 18,446,744,073,709,551,616 (about 18.4 quintillion) whenever I got negative value from my derivative that means I need to add 2 exp 64 to first value and then apply derivative. How can I implement this?

3

I figured out that I can use logstash output plugin to save the last event to file and input plugin to read them with every new event and get my data in this way.

4

It sounds like you've solved your own problem, but there is also a fitting function option in timelion that lets you fill gaps in the data.

5

How is It called? I will check that.

6

It is .fit(mode=average)

1 Like
7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.