Using rate() function in Kibana Lenses

[Ronaldo_Lanhellas]

I'm collecting metrics from kubernetes nodes using this api:

kubectl get --raw /api/v1/nodes/$1/proxy/metrics/cadvisor

And this returns the metrics in Prometheus format. So, I'm sending this to Logstash and making some transformations, see:

filter{
    mutate {
      remove_field => [ "host" ]
    }

     ruby{
        code => "
        if (event.get('[container_cpu_usage_seconds_total_container_cpu_id_image_name_namespace_pod][container_cpu_usage_seconds_total]')!=nil)
         event.set('container_cpu_usage_percent', (event.get('[container_cpu_usage_seconds_total_container_cpu_id_image_name_namespace_pod][container_cpu_usage_seconds_total]') / (event.get('machine_cpu_cores') * 100)).ceil(2))
        end
        "
    }

}

As you can see I'm trying to calculate CPU Usage % using the following formula:

container_cpu_usage_seconds_total/ (machine_cpu_cores*100)

Trying to reproduce same formula as prometheus:

rate(container_cpu_user_seconds_total[30s]) * 100

But didn't works, because I need to use something like "Serial Diff" and I tried but without success:

[wylie (Wylie Conlon)]

@Ronaldo_Lanhellas I am one of the Lens developers, and we recently added support for functions that are similar to what Prometheus offers in 7.11. You're showing a screenshot that isn't from Lens, by the way.

We have the Differences function with an advanced setting for Normalize time unit to 1 second or 1 minute.

If you need to multiply by 100, you can use a Runtime field or Scripted field from your Kibana index pattern which does the math for you. These fields will appear in the field list.

[Ronaldo_Lanhellas]

@wylie

@wylie

Differences

I made a mistake, in fact, I'm using a normal graph from kibana, not Lens, can you send a print screen where can I use "Differences" in Lens ? I didn't found it.

In Lens I just have it:

[wylie (Wylie Conlon)]

Sorry, I thought we released these in 7.11 but they are released in 7.12: What’s new in 7.12 | Kibana Guide [7.12] | Elastic

[Ronaldo_Lanhellas]

Thanks, I will update to 7.12 and give it a try.

[Ronaldo_Lanhellas]

@wylie , I updated and now I can use the "Difference" function, but how can I express percent(%) difference between two values?

For example, I have the following range:
1, 4, 10, 20

The difference function gives me:
3, 6, 10

but I need percent difference between values, to see how much grows up.

[wylie (Wylie Conlon)]

I see, that's not supported yet. You can do this using TSVB though: Visualizing observability with Kibana: Event rates and rate of change in TSVB | Elastic Blog