The reason you see the values fall off like that is due to something we refer to as "partial buckets". Basically, the time bucket you've asked for doesn't have all of its values yet, so the value you see isn't complete.
For example, if you have a lot of data and bucket on every minute, but you view the data 10 seconds after the minute, you will effectively have a "partial bucket" that is roughly 1/6th the value you might expect (10 seconds out of a 60 second bucket). You see a value because you have some data, just not all the data. This can happen on the beginning as well, where in that same example, you'd have the last 50 seconds of the minute, or 5/6th of the actual data.
Try adding .trim() to your query. It will effectively drop the first and last bucket, and then .fit('nearest') will project the values using the nearest bucket, which should flatten out the line for you. The data you see still won't be exactly correct, but it will be less incorrect than what you have now.
.es('beat.hostname:/bs<1-4>-cjj1/ AND system.network.name:bond0', metric='max:system.network.in.bytes', metric='avg:system.network.in.bytes', fit=nearest).trim().fit('nearest')
