datafeed_k8s_network_in.json

{
  "job_id": "JOB_ID",
  "indices": [
    "INDEX_PATTERN_NAME"
  ],
  "indices_options": {
    "allow_no_indices": true
  },
  "query": {
    "bool": {
      "must": [
        {
          "exists": {
            "field": "kubernetes.pod.network"
          }
        }
      ]
    }
  },
  "chunking_config": {
    "mode": "manual",
    "time_span": "900s"
  },
  "aggregations": {
    "kubernetes.namespace": {
      "terms": {
        "field": "kubernetes.namespace",
        "size": 25
      },
      "aggregations": {
        "kubernetes.pod.uid": {
          "terms": {
            "field": "kubernetes.pod.uid",
            "size": 100
          },
          "aggregations": {
            "buckets": {
              "date_histogram": {
                "field": "@timestamp",
                "fixed_interval": "5m"
              },
              "aggregations": {
                "@timestamp": {
                  "max": {
                    "field": "@timestamp"
                  }
                },
                "bytes_in_max": {
                  "max": {
                    "field": "kubernetes.pod.network.rx.bytes"
                  }
                },
                "bytes_in_derivative": {
                  "derivative": {
                    "buckets_path": "bytes_in_max"
                  }
                },
                "positive_only": {
                  "bucket_script": {
                    "buckets_path": {
                      "in_derivative": "bytes_in_derivative.value"
                    },
                    "script": "params.in_derivative > 0.0 ? params.in_derivative : 0.0"
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}