Visualizing network traffic timelion (metricbeat)

[dinon]

Hi,
I am using metricbeat to send network data to kibana from window mchine,
What hapens is that these counters are reaching max value and then going back to zero

When using below timelion formula it causes a big jump when counters are reset, how to overcome this situation?

.es(index=metricbeat-cloud-, timefield=@timestamp, metric=max:system.network.in.bytes).derivative().divide(1048576).lines(fill=2, width=1).color(green).label("Inbound traffic").title("Network traffic (MB/s)"), .es(index=metricbeat-cloud-, timefield=@timestamp, metric=max:system.network.out.bytes).derivative().multiply(-1).divide(1048576).lines(fill=2, width=1).color(red).label("Outbound traffic").legend(columns=2, position=nw)

[jbudz (Jon Budzenski)]

Can you share your version ( >= 5.4) ? If TSVB is available you can use the "Positive only" aggregation after the derivative aggregation to filter out negatives.

If not you can try digging into timelion's if statements, https://www.elastic.co/blog/timeseries-if-then-else-with-timelion has more info.