Custom/Derived Metric?

[mpn17]

Hi All!

I'm new to Elasticsearch and Kibana and trying to figure out the best way to create a custom metric that takes into account the current value of other metrics.

For example lets say I want to create a custom string metric to look at my host's health. I'm collecting CPU % and Mem Usage and I want to create a derived metric (string) based off the current value of the CPU and Mem Usage metrics. What's the best way to achieve this?

Thanks!

[mikecote (Mike)]

Hi @mpn17,

I believe creating a scripted field on an index pattern is what you're looking for to solve this. You can find the documentation here: https://www.elastic.co/guide/en/kibana/current/scripted-fields.html.

[mpn17]

@mikecote Thanks for the response. I noticed for scripted fields you can only access a single document at a time, albeit multiple fields. Additionally I was reading that metricbeat stores multiple metrics inside of a single event in a nested JSON document. So for example if I had the AWS module enabled, and was pulling metrics from the "cloudwatch" metricset, would it store all the metrics collected from that metricset in a single nested JSON document? In turn would I then be able to use scripted fields to access multiple metrics considering it would all be in a single document?

Thanks again!

[mikecote (Mike)]

Hi @mpn17,

I believe this would be doable within the metric visualization builder. You should be able to accomplish this by using some of the features like; filters, aggregation and split groups.