Derivative metric, incorrect graph representation

Hi all,

I am having issue with representation of the values when derivative metric is used and timeperiod larger than i.e. today is selected. Examples below :

Incorrect time range (zoomed)
image

Real counter values for incorrectly presented range

2018-08-08 11:00:00,10.234.0.177,SERVER 10.234.0.177, ,transactions.success,13724792
2018-08-08 11:00:00,10.234.0.178,SERVER2 10.234.0.178, ,transactions.success,46843041
2018-08-08 11:00:00,10.234.0.179,SERVER3 10.234.0.179, ,transactions.success,9355
2018-08-08 11:00:00,10.234.0.179,SERVER3 10.234.0.179, ,transactions.success,1296915
2018-08-08 11:05:00,10.234.0.178,SERVER2 10.234.0.178, ,transactions.success,46851517
2018-08-08 11:05:00,10.234.0.177,SERVER 10.234.0.177, ,transactions.success,13726920
2018-08-08 11:05:00,10.234.0.179,SERVER3 10.234.0.179, ,transactions.success,9355
2018-08-08 11:05:00,10.234.0.179,SERVER3 10.234.0.179, ,transactions.success,1296915
2018-08-08 11:10:00,10.234.0.177,SERVER 10.234.0.177, ,transactions.success,13728876
2018-08-08 11:10:00,10.234.0.178,SERVER2 10.234.0.178, ,transactions.success,46860503
2018-08-08 11:10:00,10.234.0.179,SERVER3 10.234.0.179, ,transactions.success,9355
2018-08-08 11:10:00,10.234.0.179,SERVER3 10.234.0.179, ,transactions.success,1297477
2018-08-08 11:15:00,10.234.0.177,SERVER 10.234.0.177, ,transactions.success,13730787
2018-08-08 11:15:00,10.234.0.178,SERVER2 10.234.0.178, ,transactions.success,46869156
2018-08-08 11:15:00,10.234.0.179,SERVER3 10.234.0.179, ,transactions.success,9355
2018-08-08 11:15:00,10.234.0.179,SERVER3 10.234.0.179, ,transactions.success,1297477
2018-08-08 11:20:00,10.234.0.177,SERVER 10.234.0.177, ,transactions.success,13732801
2018-08-08 11:20:00,10.234.0.178,SERVER2 10.234.0.178, ,transactions.success,46878199
2018-08-08 11:20:00,10.234.0.179,SERVER3 10.234.0.179, ,transactions.success,9356
2018-08-08 11:20:00,10.234.0.179,SERVER3 10.234.0.179, ,transactions.success,1297477
2018-08-08 11:25:00,10.234.0.177,SERVER 10.234.0.177, ,transactions.success,13734758
2018-08-08 11:25:00,10.234.0.178,SERVER2 10.234.0.178, ,transactions.success,46886003
2018-08-08 11:25:00,10.234.0.179,SERVER3 10.234.0.179, ,transactions.success,9356
2018-08-08 11:25:00,10.234.0.179,SERVER3 10.234.0.179, ,transactions.success,1297839
2018-08-08 11:30:00,10.234.0.177,SERVER 10.234.0.177, ,transactions.success,13736679
2018-08-08 11:30:00,10.234.0.178,SERVER2 10.234.0.178, ,transactions.success,46894367
2018-08-08 11:30:00,10.234.0.179,SERVER3 10.234.0.179, ,transactions.success,9356
2018-08-08 11:30:00,10.234.0.179,SERVER3 10.234.0.179, ,transactions.success,1298035

Query setting

image

Stats are with 5m resolution, and @timestamp interval is set accordingly to 5m.
However, sometimes but not always, I am seeing these positive/negative graph peaks when I expand graph timerange to be shown (i.e. to 2days, 7days). Based on real counter values I extracted, it looks like delta between two successive intervals is not done, but just current counter value represented. Could you please help and check if anything to the setup is incorrect and give some advice how to solve this ?

Thanks

Not sure, the derivative is done by elasticsearch, maybe there is an option for the derivative that can fix it?

Thanks for quick feedback and hint.

I tried with several derivative options (setting different time Units) but couldn´t manage to fix this issue with elasticsearch.

Values are still inccorect when longer period selected

Any additional advice/configuration/idea that might help to overcome this issue, would be appreciated

Thanks