Using the holt function in Timelion to do anomaly detection on Metricbeat data in Kibana: Expression: $thres=0.02, .es(index='metricbeat*',metric='max:system.cpu.user.pct').lines(1).if(eq, 0, null).holt(0.9, 0.1, 0.9, 0.5h).color(#eee).lines(10).label('Prediction'), .es(index='metricbeat*',metric='max:system.cpu.user.pct').color(#666).lines(1).label(Actual), .es(index='metricbeat*',metric='max:system.cpu.user.pct').lines(1).if(eq, 0, null).holt(0.9, 0.1, 0.9, 0.5h).subtract(.es(index='metricbeat*',metric='max:system.cpu.user.pct')).abs().if(lt, $thres, null, .es(index='metricbeat*',metric='max:system.cpu.user.pct')).points(10,3,0).color(#c66).label('Anomaly').title('max:system.cpu.user.pct / @rmoff') References: https://twitter.com/rashidkpc/status/762754396111327232 https://github.com/elastic/timelion/issues/87 https://github.com/elastic/timelion/blob/master/FUNCTIONS.md

I wrote recently about Kibana’s excellent Timelion feature, which brings time-series visualisations to Kibana. In the comments Ben Huang asked: do you know how to show whats the difference between this Friday and last Friday by Timelion? So I thought I’d answer properly here. Timelion includes mathematical functions including add and subtract, as well as the ability to show data offset by an amount of time. So to answer Ben’s query, we combine the two.

Yesterday I wrote about Monitoring Logstash Ingest Rates with InfluxDB and Grafana, in which InfluxDB provided the data store for the ingest rate data, and Grafana the frontend. Mark Walkom reminded me on twitter that the next release of Logstash will add more functionality in this area - and that it’ll integrate back into the Elastic stack: @rmoff nice, LS 5.0 will have APIs exposing metrics too. they’ll be integrated back into Marvel/Monitoring!

Timelion was released in November 2015 and with the 4.4.2 release of Kibana is available as a native visualisation once installed. It adds some powerful capabilities to Kibana as an timeseries analysis tool, using its own data manipulation language. Installing Timelion is a piece of cake: ./bin/kibana plugin -i kibana/timelion After restarting Kibana, you’ll see it as an option from the application picker There’s a bit of a learning curve with Timelion, but it’s worth it.