I'm just getting started with ELK, and we're wanting to use Kibana to visualise the performance of some of our servers.
In the first instance, I'm trying to put some network usage data in using collectd on a few servers. Collectd is sending through a record with a type of if_octets containing fields called rx and tx. These fields contain a count of the number of octets received and sent through the network interface. As great as this is, I'd like to visualise these in terms of the amount they change (ie I'd like to see rx octets per second and tx octets per second). I have similar requirements for the various records collectd can emit from its cpu plugin.
Searching for an easy way to do this is coming up blank for me. The only way I've found so far is to use the elasticsearch filter in logstash to pull in the value and timestamp from the previous record and put those through a ruby filter to calculate the metric I want. This works, but my small test environment blocked pretty quickly once I started looking up records in the filter for more than just a couple of the types that collectd is sending through. The other downside is that I'm having to calculate this when the record is initially processed by logstash. If I identify another similar field that I need to have this sort of visualisation for at some point in the future, I'll have to find a way to modify the already indexed documents in elasticsearch to add this, or miss out on having it available for historical data.
So, does anyone know of a better way to do this sort of thing?