Cannot seem to get a network utilization graph

[wil]

This seems like it should be easy, but for whatever reason my graph just sums up total network utilization. I’d like the traditional network graph where it shows how many octets per second are being used, and for the life of me I can’t seem to get this query going. (I’m pretty new to Grafana, if that isn’t obvious.)

To be clear, the ‘rx’ and ‘tx’ numbers keep climbing and I need the difference between.

I’m using Elasticsearch and my data looks like this:

  {
    "_index" : "logstash-2018.12.02",
    "_type" : "doc",
    "_id" : "stU5bGcBBnbH8W0pdBvp",
    "_score" : 1.0,
    "_source" : {
      "host" : "wil-tsdb-test",
      "rx" : 176669884,
      "@timestamp" : "2018-12-02T00:02:43.943Z",
      "@version" : "1",
      "tx" : 1949413576,
      "plugin" : "interface",
      "type" : "collectd",
      "plugin_instance" : "ens160",
      "collectd_type" : "if_octets"
    }

Here’s what the graph and query currently look like.