Add non-negative option to derivative aggregation

[felixbarny]

The derivative aggregation is great for getting the changes in a variable such as a packet counter. Some variables, however, wrap around or reset to zero (such as after a server reboot).

I would find it very useful to have non negative derivative option, where a negative change is regarded as a zero change.

[clintongormley]

@colings86 what do you think?

[bleskes]

I wonder if we should treat a negative derivative as a non-value/null and let the gap policy decide what to do.

On 10 Jan 2016, at 21:39, Clinton Gormley [email protected] wrote:

@colings86 what do you think?

—
Reply to this email directly or view it on GitHub.

[colings86]

Personally I would like to keep the logic in the derivative simple and have it working out the derivative in the standard way (where the result can be positive or negative). This makes it very easy for users to know what the derivative aggregation does. For cases such as this we already have a couple of options which could be used to :

• Use the bucket_selector aggregation to only keep the buckets which have a non-negative value for the derivative
• Use the bucket_script aggregation to run a script on each bucket which outputs the value of the aggregation if the derivative value is non-negative or a default value (could be zero) for negative values
• Use the bucket_script aggregation to detect the wrap_around/reset and calculate the actual change in the counter. By this I mean, if you know your values go up to 1000 before they wrap around and you have a value of the derivative of -900 and a value for the counter value of 50 then you know the previous buckets value was 950 and the corrected derivative value (accounting for the wrap_around) should be 100.

IMO they are many things that you might want to do in this (and other use-cases) with the output of the derivative and it would be better to support the various possibilities using other aggregations to process the derivatives output then to try to support everything in the derivative aggregation

[clintongormley]

@colings86 ++ makes sense, thanks. Closing