# Timelion & Metricbeats values falling off **URL:** \ **Category:** Kibana\ **Created:** [April 6, 2017, 9:05pm UTC](https://discuss.elastic.co/t/timelion-metricbeats-values-falling-off/81538 "2017-04-06T21:05:27Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Chris\_Marzullo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chris_marzullo/32/17132_2.png) [@Chris\_Marzullo](https://discuss.elastic.co/u/Chris_Marzullo)\ **Post date:** [April 6, 2017, 9:05pm UTC](https://discuss.elastic.co/t/timelion-metricbeats-values-falling-off/81538/1 "2017-04-06T21:05:27Z")
So one of the things I'm failing to grasp with what combination of 'fit' values I need so my graph doesn't drop off like it does in the attached picture. I can refresh and sometimes it goes away, but it'll come back. Lots of confusion by people when looking at these graphs. Here's the expression I'm using: `.es('beat.hostname:/bs<1-4>-cjj1/ AND system.network.name:bond0', metric='max:system.network.in.bytes', metric='avg:system.network.in.bytes', fit=nearest).fit('nearest')` ![](https://us1.discourse-cdn.com/elastic/original/3X/c/b/cbe029d067f4b4b8587bd38e47033036b31acabf.png) And if I press enter again in the field it clears up. ![](https://us1.discourse-cdn.com/elastic/original/3X/5/2/52b6b4a719bcb5cf9798386f953d6bfd82543385.png) ---
**Author:** ![Joe\_Fleming](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_fleming/32/3561_2.png) [@Joe\_Fleming](https://discuss.elastic.co/u/Joe_Fleming)\ **Post date:** [April 6, 2017, 9:18pm UTC](https://discuss.elastic.co/t/timelion-metricbeats-values-falling-off/81538/2 "2017-04-06T21:18:59Z")
The reason you see the values fall off like that is due to something we refer to as "partial buckets". Basically, the time bucket you've asked for doesn't have all of its values yet, so the value you see isn't complete. For example, if you have a lot of data and bucket on every minute, but you view the data 10 seconds after the minute, you will effectively have a "partial bucket" that is roughly 1/6th the value you might expect (10 seconds out of a 60 second bucket). You see a value because you have _some_ data, just not all the data. This can happen on the beginning as well, where in that same example, you'd have the last 50 seconds of the minute, or 5/6th of the actual data. Try adding [.trim()](https://github.com/elastic/timelion/blob/master/FUNCTIONS.md#trim) to your query. It will effectively drop the first and last bucket, and then `.fit('nearest')` will project the values using the nearest bucket, which should flatten out the line for you. The data you see still won't be exactly correct, but it will be _less incorrect_ than what you have now. ```auto .es('beat.hostname:/bs<1-4>-cjj1/ AND system.network.name:bond0', metric='max:system.network.in.bytes', metric='avg:system.network.in.bytes', fit=nearest).trim().fit('nearest') ``` ---
**Author:** ![Chris\_Marzullo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chris_marzullo/32/17132_2.png) [@Chris\_Marzullo](https://discuss.elastic.co/u/Chris_Marzullo)\ **Post date:** [April 7, 2017, 11:17am UTC](https://discuss.elastic.co/t/timelion-metricbeats-values-falling-off/81538/3 "2017-04-07T11:17:03Z")
Thanks so much Joe! I was able to start building what I envision. Here's to hoping we get some UI improvements in the future! 🕶 --C ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 5, 2017, 11:29am UTC](https://discuss.elastic.co/t/timelion-metricbeats-values-falling-off/81538/4 "2017-05-05T11:29:16Z")
Closed on May 5, 2017, 11:29am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.