# Trying to build Timelion charts with metricbeat data

**URL:** <https://discuss.elastic.co/t/trying-to-build-timelion-charts-with-metricbeat-data/65006>\
**Category:** Kibana\
**Created:** [November 4, 2016, 12:04pm UTC](https://discuss.elastic.co/t/trying-to-build-timelion-charts-with-metricbeat-data/65006 "2016-11-04T12:04:43Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tomx1](https://avatars.discourse-cdn.com/v4/letter/t/779978/32.png) [@tomx1](https://discuss.elastic.co/u/tomx1)\
**Post date:** [November 4, 2016, 12:04pm UTC](https://discuss.elastic.co/t/trying-to-build-timelion-charts-with-metricbeat-data/65006/1 "2016-11-04T12:04:43Z")

</div>

Hey Folks,

I have installed Kibana v5 and I'm trying to build some nice Timelion charts using postgres metrics data collected via Metricbeat. I have noticed a strange issue, maybe I'm missing the point here:

I'm using the following query to draw two metricsets located on the same chart:  
.es(metric=cardinality:postgresql.database.rows.deleted).label('rows deleted'), .es(metric=cardinality:postgresql.database.rows.updated).label('rows inserted')

Due some strange reason the chart looks like this:

 ![](https://us1.discourse-cdn.com/elastic/original/2X/c/c4d901ccd7017309a94003789cab2daab6dd7a26.png)

So the request for 'rows deleted' seems to be fine (although i don't understand why the y-axis counter has only a range from 0-70). The line for 'rows inserted' is definetly not what i would expect that it should look like. Can someone tell me why?

Heres a part of "raw" data:

```
"postgresql": {
  "database": {
    "blocks": {
      "hit": 2924945303,
      "read": 395660,
      "time": {
        "read": {
          "ms": 0
        },
        "write": {
          "ms": 0
        }
      }
    },
    "conflicts": 0,
    "deadlocks": 0,
    "name": "xxx",
    "number_of_backends": 34,
    "oid": 16414,
    "rows": {
      "deleted": 11493269,
      "fetched": 2173275568,
      "inserted": 13233679,
      "returned": 42991645961,
      "updated": 33534467
    },
```

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [November 4, 2016, 4:53pm UTC](https://discuss.elastic.co/t/trying-to-build-timelion-charts-with-metricbeat-data/65006/2 "2016-11-04T16:53:47Z")

</div>

Hi,

If you are referring to the sudden rise and drop at the ends of the "rows inserted" series, that might be because the x-axis time buckets at those points contain partial data. Try adding `.trim()` to the series definition expression.

Also, this might be irrelevant, but I just noticed that the series labeled "rows inserted" is actually using the `postgresql.database.rows.updated` field. Should it be using the `postgresql.database.rows.inserted` field instead?

Shaunak

---

<div class="post-metadata">

**Author:** ![tomx1](https://avatars.discourse-cdn.com/v4/letter/t/779978/32.png) [@tomx1](https://discuss.elastic.co/u/tomx1)\
**Post date:** [November 7, 2016, 8:27am UTC](https://discuss.elastic.co/t/trying-to-build-timelion-charts-with-metricbeat-data/65006/3 "2016-11-07T08:27:20Z")

</div>

Ok, maybe i was a bit unprecise here 🙂

The obvious thing about this chart is, that the line for 'rows inserted' is just straight. There is no fluctuation in it, it is defnitely not representing the data as it is. Here is some example data:

> 'rows deleted' 'rows inserted'  
> 99 78  
> 13,549,210 11,762,099  
> 99 78  
> 0 0  
> 99 78  
> 13,549,204 11,762,098  
> 0 0  
> 99 78  
> 99 78  
> 0 0  
> 99 78  
> 13,549,194 11,762,098  
> 99 78  
> 13,549,184 11,762,098  
> 99 78  
> 0 0  
> 13,549,176 11,762,098  
> 99 78  
> 0 0  
> 99 78

And yes, you are right... in my example I have accidentally used 'postgresql.database.rows.updated' for 'rows inserted'. The reason is that i have tested several 'postgresql.database.rows.\*' fields, all of them are showing pretty the same fluctuation as you can see in the expample data above. But only the field 'postgresql.database.rows.deleted' is showing a reasonable graph.

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [November 23, 2016, 3:07am UTC](https://discuss.elastic.co/t/trying-to-build-timelion-charts-with-metricbeat-data/65006/4 "2016-11-23T03:07:18Z")

</div>

I _think_ this is happening because you are using the "cardinality" metric. This gives you the count of unique values in a field. So, for example, in the example data you provided, there are 4 unique values for the "rows inserted" field: 78, 11762099, 0, and 11762098.

I suspect what you want to use instead of "cardinality" is "sum" or possibly "avg".

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:34pm UTC](https://discuss.elastic.co/t/trying-to-build-timelion-charts-with-metricbeat-data/65006/5 "2017-07-06T13:34:03Z")

</div>

Closed on July 6, 2017, 1:34pm UTC