You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -50,10 +50,10 @@ To compare the two data sets, add another series with data from the previous hou
50
50
.es(index=metricbeat-*,
51
51
timefield='@timestamp',
52
52
metric='avg:system.cpu.user.pct'),
53
-
.es(offset=-1h, <1>
54
-
index=metricbeat-*,
55
-
timefield='@timestamp',
56
-
metric='avg:system.cpu.user.pct')
53
+
.es(offset=-1h, <1>
54
+
index=metricbeat-*,
55
+
timefield='@timestamp',
56
+
metric='avg:system.cpu.user.pct')
57
57
----------------------------------
58
58
59
59
<1> `offset` offsets the data retrieval by a date expression. In this example, `-1h` offsets the data back by one hour.
@@ -119,11 +119,11 @@ To differentiate between the current hour data and the last hour data, change th
119
119
metric='avg:system.cpu.user.pct')
120
120
.label('last hour')
121
121
.lines(fill=1,width=0.5), <1>
122
-
.es(index=metricbeat-*,
123
-
timefield='@timestamp',
124
-
metric='avg:system.cpu.user.pct')
125
-
.label('current hour')
126
-
.title('CPU usage over time')
122
+
.es(index=metricbeat-*,
123
+
timefield='@timestamp',
124
+
metric='avg:system.cpu.user.pct')
125
+
.label('current hour')
126
+
.title('CPU usage over time')
127
127
----------------------------------
128
128
129
129
<1> `.lines()` changes the appearance of the chart lines. In this example, `.lines(fill=1,width=0.5)` sets the fill level to `1`, and the border width to `0.5`.
@@ -169,7 +169,20 @@ Change the position and style of the legend:
<1> `.legend()` sets the position and style of the legend. In this example, `.legend(columns=2, position=nw)` places the legend in the north west position of the visualization with two columns.
@@ -192,7 +205,9 @@ To start tracking the inbound and outbound network traffic, enter the following
<1> `.multiply()` multiplies the data series by a number, the result of a data series, or a list of data series. For this example, `.multiply(-1)` converts the outbound network traffic to a negative value since the outbound network traffic is leaving your machine.
@@ -237,7 +263,17 @@ To make the visualization easier to analyze, change the data metric from bytes t
@@ -338,17 +376,17 @@ To track the amount of memory used, create two thresholds:
338
376
null)
339
377
.label('warning')
340
378
.color('#FFCC11'),
341
-
.es(index=metricbeat-*,
342
-
timefield='@timestamp',
343
-
metric='max:system.memory.actual.used.bytes')
344
-
.if(gt,
345
-
11375000000,
346
-
.es(index=metricbeat-*,
347
-
timefield='@timestamp',
348
-
metric='max:system.memory.actual.used.bytes'),
349
-
null)
350
-
.label('severe')
351
-
.color('red')
379
+
.es(index=metricbeat-*,
380
+
timefield='@timestamp',
381
+
metric='max:system.memory.actual.used.bytes')
382
+
.if(gt,
383
+
11375000000,
384
+
.es(index=metricbeat-*,
385
+
timefield='@timestamp',
386
+
metric='max:system.memory.actual.used.bytes'),
387
+
null)
388
+
.label('severe')
389
+
.color('red')
352
390
----------------------------------
353
391
354
392
<1> Timelion conditional logic for the _greater than_ operator. In this example, the warning threshold is 11.3GB (`11300000000`), and the severe threshold is 11.375GB (`11375000000`). If the threshold values are too high or low for your machine, adjust the values accordingly.
@@ -366,7 +404,33 @@ To determine the trend, create a new data series:
<1> `mvavg()` calculates the moving average over a specified period of time. In this example, `.mvavg(10)` creates a moving average with a window of 10 data points.
@@ -396,30 +460,30 @@ Customize and format the visualization using functions:
396
460
.es(index=metricbeat-*,
397
461
timefield='@timestamp',
398
462
metric='max:system.memory.actual.used.bytes'),
399
-
null)
400
-
.label('warning')
401
-
.color('#FFCC11') <3>
402
-
.lines(width=5), <4>
403
-
.es(index=metricbeat-*,
404
-
timefield='@timestamp',
405
-
metric='max:system.memory.actual.used.bytes')
406
-
.if(gt,
407
-
11375000000,
408
-
.es(index=metricbeat-*,
409
-
timefield='@timestamp',
410
-
metric='max:system.memory.actual.used.bytes'),
411
-
null)
412
-
.label('severe')
413
-
.color('red')
414
-
.lines(width=5),
463
+
null)
464
+
.label('warning')
465
+
.color('#FFCC11') <3>
466
+
.lines(width=5), <4>
467
+
.es(index=metricbeat-*,
468
+
timefield='@timestamp',
469
+
metric='max:system.memory.actual.used.bytes')
470
+
.if(gt,
471
+
11375000000,
415
472
.es(index=metricbeat-*,
416
473
timefield='@timestamp',
417
-
metric='max:system.memory.actual.used.bytes')
418
-
.mvavg(10)
419
-
.label('mvavg')
420
-
.lines(width=2)
421
-
.color(#5E5E5E)
422
-
.legend(columns=4, position=nw) <5>
474
+
metric='max:system.memory.actual.used.bytes'),
475
+
null)
476
+
.label('severe')
477
+
.color('red')
478
+
.lines(width=5),
479
+
.es(index=metricbeat-*,
480
+
timefield='@timestamp',
481
+
metric='max:system.memory.actual.used.bytes')
482
+
.mvavg(10)
483
+
.label('mvavg')
484
+
.lines(width=2)
485
+
.color(#5E5E5E)
486
+
.legend(columns=4, position=nw) <5>
423
487
----------------------------------
424
488
425
489
<1> `.label()` adds custom labels to the visualization.
0 commit comments