Think I've answered part of my question.... m1_rate is not representing the count of logs over the last minute, but the mean rate of logs over the last minute. So if we get 10 log/sec, the m1_rate will be still be 10, regardless of the fact that we received 600 logs.
In this case using 10*60 will give us the number of logs, but only because the man rate was in fact constant. This explains why the m1_rate of 420 was so close to the derivative of 474. The only meter metric I can't figure out is mean_rate, is that the mean rate since the plugin was last started? But, this still does not explain why the result in Graylog itself differ from the derivative rate though? -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/6fada87b-ca2e-4d5e-af13-fe74c5961434%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
