Timelion & Metricbeats values falling off

[Chris_Marzullo]

So one of the things I'm failing to grasp with what combination of 'fit' values I need so my graph doesn't drop off like it does in the attached picture. I can refresh and sometimes it goes away, but it'll come back. Lots of confusion by people when looking at these graphs.

Here's the expression I'm using:
.es('beat.hostname:/bs<1-4>-cjj1/ AND system.network.name:bond0', metric='max:system.network.in.bytes', metric='avg:system.network.in.bytes', fit=nearest).fit('nearest')

And if I press enter again in the field it clears up.

[Joe_Fleming]

The reason you see the values fall off like that is due to something we refer to as "partial buckets". Basically, the time bucket you've asked for doesn't have all of its values yet, so the value you see isn't complete.

For example, if you have a lot of data and bucket on every minute, but you view the data 10 seconds after the minute, you will effectively have a "partial bucket" that is roughly 1/6th the value you might expect (10 seconds out of a 60 second bucket). You see a value because you have some data, just not all the data. This can happen on the beginning as well, where in that same example, you'd have the last 50 seconds of the minute, or 5/6th of the actual data.

Try adding .trim() to your query. It will effectively drop the first and last bucket, and then .fit('nearest') will project the values using the nearest bucket, which should flatten out the line for you. The data you see still won't be exactly correct, but it will be less incorrect than what you have now.

.es('beat.hostname:/bs<1-4>-cjj1/ AND system.network.name:bond0', metric='max:system.network.in.bytes', metric='avg:system.network.in.bytes', fit=nearest).trim().fit('nearest')

[Chris_Marzullo]

Thanks so much Joe! I was able to start building what I envision.

Here's to hoping we get some UI improvements in the future!

--C