Elastic Alert

Hello everyone,
I am trying to set up an alert when the CPU is 100% for => 20 minutes.
Here is my setup

But the alert comes even if it is only 100% for a few minutes.
Is there something wrong with the configuration?

Hi @wijamw

What version of the stack?

Do you have multiple hosts?

I think that graph sometimes is a bit misleading as I think it is an average of all the hosts.

When you get the alert did you look at the individual host and see is CPU is above for 20 mins?

It was version 7.17 Elastic Cloud Stack
Yes, I have multiple hosts and I have set up a filter on the alert condition.
The filter looks like this:

data_stream.dataset : "system.cpu" AND agent.hostname: ("hostname1" OR "hostname2" OR "hostname3")

Yes, I did, the CPU was 100% for one of the hosts for a minute or two.

I looked at Metric Threshold

So on my 7.17.6 I need to put in 100 to be 100% it looks like you put in 1 and it is 100%

Metric Threshold

Perhaps you should try that...

You did not tell me the exact version perhaps upgrade to 7.17.6

Look like you are using an Inventory Rule looks like that take a 1... perhaps a bug with custom % metric ...

Perhaps try Metric Threshold.

My bad, it is 7.17.0
Do the deployment need to be restarted if I want to upgrade it?

Yes, I am using inventory rule.
Thanks, I will try the metric threshold.