Rate of change: derivative pipeline
The change in volume between consecutive buckets, computed Elasticsearch-style with the derivative pipeline (the deriv.value object, null on the first bucket), colored by sign — sample buckets inline.
Prerequisites
Kibana 7.10+, Elasticsearch
Vega-Lite
{
"$schema": "https://vega.github.io/schema/vega-lite/v5.json",
"data": {
"values": [
{ "key": "2026-06-08T09:00:00", "deriv": null },
{ "key": "2026-06-08T09:05:00", "deriv": { "value": 32 } },
{ "key": "2026-06-08T09:10:00", "deriv": { "value": -18 } },
{ "key": "2026-06-08T09:15:00", "deriv": { "value": 124 } },
{ "key": "2026-06-08T09:20:00", "deriv": { "value": 260 } },
{ "key": "2026-06-08T09:25:00", "deriv": { "value": -340 } },
{ "key": "2026-06-08T09:30:00", "deriv": { "value": -85 } },
{ "key": "2026-06-08T09:35:00", "deriv": { "value": 42 } },
{ "key": "2026-06-08T09:40:00", "deriv": { "value": 96 } },
{ "key": "2026-06-08T09:45:00", "deriv": { "value": -54 } }
]
},
"transform": [{ "calculate": "datum.deriv ? datum.deriv.value : 0", "as": "delta" }],
"mark": "bar",
"encoding": {
"x": { "field": "key", "type": "temporal", "title": null },
"y": { "field": "delta", "type": "quantitative", "title": "Δ docs / bucket" },
"color": {
"condition": { "test": "datum.delta >= 0", "value": "#2e7d32" },
"value": "#c62828"
}
}
}KibanaderivativePipeline aggMonitoring