Derivative metric, incorrect graph representation

Hi all,

I am having issue with representation of the values when derivative metric is used and timeperiod larger than i.e. today is selected. Examples below :

Incorrect time range (zoomed)

Real counter values for incorrectly presented range

2018-08-08 11:00:00,,SERVER, ,transactions.success,13724792
2018-08-08 11:00:00,,SERVER2, ,transactions.success,46843041
2018-08-08 11:00:00,,SERVER3, ,transactions.success,9355
2018-08-08 11:00:00,,SERVER3, ,transactions.success,1296915
2018-08-08 11:05:00,,SERVER2, ,transactions.success,46851517
2018-08-08 11:05:00,,SERVER, ,transactions.success,13726920
2018-08-08 11:05:00,,SERVER3, ,transactions.success,9355
2018-08-08 11:05:00,,SERVER3, ,transactions.success,1296915
2018-08-08 11:10:00,,SERVER, ,transactions.success,13728876
2018-08-08 11:10:00,,SERVER2, ,transactions.success,46860503
2018-08-08 11:10:00,,SERVER3, ,transactions.success,9355
2018-08-08 11:10:00,,SERVER3, ,transactions.success,1297477
2018-08-08 11:15:00,,SERVER, ,transactions.success,13730787
2018-08-08 11:15:00,,SERVER2, ,transactions.success,46869156
2018-08-08 11:15:00,,SERVER3, ,transactions.success,9355
2018-08-08 11:15:00,,SERVER3, ,transactions.success,1297477
2018-08-08 11:20:00,,SERVER, ,transactions.success,13732801
2018-08-08 11:20:00,,SERVER2, ,transactions.success,46878199
2018-08-08 11:20:00,,SERVER3, ,transactions.success,9356
2018-08-08 11:20:00,,SERVER3, ,transactions.success,1297477
2018-08-08 11:25:00,,SERVER, ,transactions.success,13734758
2018-08-08 11:25:00,,SERVER2, ,transactions.success,46886003
2018-08-08 11:25:00,,SERVER3, ,transactions.success,9356
2018-08-08 11:25:00,,SERVER3, ,transactions.success,1297839
2018-08-08 11:30:00,,SERVER, ,transactions.success,13736679
2018-08-08 11:30:00,,SERVER2, ,transactions.success,46894367
2018-08-08 11:30:00,,SERVER3, ,transactions.success,9356
2018-08-08 11:30:00,,SERVER3, ,transactions.success,1298035

Query setting


Stats are with 5m resolution, and @timestamp interval is set accordingly to 5m.
However, sometimes but not always, I am seeing these positive/negative graph peaks when I expand graph timerange to be shown (i.e. to 2days, 7days). Based on real counter values I extracted, it looks like delta between two successive intervals is not done, but just current counter value represented. Could you please help and check if anything to the setup is incorrect and give some advice how to solve this ?


Not sure, the derivative is done by elasticsearch, maybe there is an option for the derivative that can fix it?

Thanks for quick feedback and hint.

I tried with several derivative options (setting different time Units) but couldn´t manage to fix this issue with elasticsearch.

Values are still inccorect when longer period selected

Any additional advice/configuration/idea that might help to overcome this issue, would be appreciated