# Filebeat CPU utilization metrics are not normalized by default
**URL:** https://discuss.elastic.co/t/filebeat-cpu-utilization-metrics-are-not-normalized-by-default/210659
**Category:** Beats
**Tags:** elastic-stack-monitoring
**Created:** [December 5, 2019, 9:24am UTC](https://discuss.elastic.co/t/filebeat-cpu-utilization-metrics-are-not-normalized-by-default/210659 "2019-12-05T09:24:00Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@marko\_vranjkovic](https://discuss.elastic.co/u/marko_vranjkovic)
#### Post date: [December 5, 2019, 9:24am UTC](https://discuss.elastic.co/t/filebeat-cpu-utilization-metrics-are-not-normalized-by-default/210659/1 "2019-12-05T09:24:00Z")
Can someone confirm that by using all default settings Filebeat CPU utilization metrics in Kibana stack monitoring are not normalized, e.g. for 4 CPUs the CPU utilization goes from 0% to 400%.
This question is just a first part from the original question: [Kibana stack monitoring: Normalized vs not-normalized CPU utilization](https://discuss.elastic.co/t/kibana-stack-monitoring-normalized-vs-not-normalized-cpu-utilization/210133)
---
### Author:  [@chrisronline](https://discuss.elastic.co/u/chrisronline)
#### Post date: [December 9, 2019, 9:24pm UTC](https://discuss.elastic.co/t/filebeat-cpu-utilization-metrics-are-not-normalized-by-default/210659/2 "2019-12-09T21:24:31Z")
I'm not sure I'm following.
I answered [Elasticsearch CPU utilization metrics are normalized by default](https://discuss.elastic.co/t/elasticsearch-cpu-utilization-metrics-are-normalized-by-default/210660) but assumed you were talking about cpu percentage differences between what you see in Stack Monitoring and what you see in the Infra UI (or, what you see in `.monitoring-es-*` documents versus what you see in `metricbeat-*` documents).
Did I assume correctly? Or are you talking about monitoring Filebeat within the Stack Monitoring UI?
---
### Author:  [@marko\_vranjkovic](https://discuss.elastic.co/u/marko_vranjkovic)
#### Post date: [December 10, 2019, 8:54am UTC](https://discuss.elastic.co/t/filebeat-cpu-utilization-metrics-are-not-normalized-by-default/210659/3 "2019-12-10T08:54:15Z")
what I meant is: if you enable stack monitoring in Filebeat by putting
```
monitoring:
enabled: true
```
in **filebeat.yml**
are the CPU utilization metrics for Filebeat that are visible in Kibana: normalized or not normalized?
Same thing for Elasticsearch:
If I enable metrics by adding below to **elasticsearch.yml** :
```
xpack:
monitoring.collection.enabled: true
```
Are the CPU utilization metrics that are shown in Kibana: normalized or not normalized?
My conclusion was that
- Filebeat metrics are not normalized
- Elasticsearch metrics are normalized
I need someone to confirm that.
---
### Author:  [@chrisronline](https://discuss.elastic.co/u/chrisronline)
#### Post date: [December 10, 2019, 8:08pm UTC](https://discuss.elastic.co/t/filebeat-cpu-utilization-metrics-are-not-normalized-by-default/210659/4 "2019-12-10T20:08:08Z")
I see.
That's a good question.
I'm not sure about the exact code path, but [this code](https://github.com/elastic/beats/blob/master/libbeat/metric/system/cpu/cpu.go#L115) leads me to believe it _is not_ normalized across cores.
@ruflin will know more about this
---
### Author:  [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [December 12, 2019, 2:23pm UTC](https://discuss.elastic.co/t/filebeat-cpu-utilization-metrics-are-not-normalized-by-default/210659/5 "2019-12-12T14:23:41Z")
Hi @marko_vranjkovic,
I traced through the Beats code and can confirm that the CPU usage reported to stack monitoring for a Beat is **not** normalized by number of cores. Details of my code trace are below.
Working backwards from the Stack Monitoring UI code to the Beats code:
1. The chart that you see in the Stack Monitoring UI is based on the [`beats_stats.metrics.beat.cpu.total.value` field](https://github.com/elastic/kibana/blob/master/x-pack/legacy/plugins/monitoring/server/lib/metrics/beats/metrics.js#L356) from documents in the `.monitoring-beats-*` index.
2. These documents are indexed periodically (default every 10 seconds) by the Beat.
3. The value of this field comes from [here in the Beats code](https://github.com/elastic/beats/blob/768b8ae0d4a039d16ade01d5cc36030c1ee6e5f0/libbeat/cmd/instance/metrics.go#L159).
4. Jumping through a couple more function calls, the value of that field is taken from [here](https://github.com/elastic/beats/blob/768b8ae0d4a039d16ade01d5cc36030c1ee6e5f0/libbeat/metric/system/process/process.go#L315). As you can see a couple lines later, Beats actually does have access to the normalized CPU percentage value, but at the moment we are not sending it to stack monitoring, so the UI cannot use it.
---
### Author:  [@chrisronline](https://discuss.elastic.co/u/chrisronline)
#### Post date: [December 12, 2019, 6:33pm UTC](https://discuss.elastic.co/t/filebeat-cpu-utilization-metrics-are-not-normalized-by-default/210659/6 "2019-12-12T18:33:05Z")
Thanks for weighing in @shaunak
@marko_vranjkovic
This is definitely a poor UX. We're going to open a set of issues to resolve this (one of which is [https://github.com/elastic/kibana/issues/52889](https://github.com/elastic/kibana/issues/52889)) and I'll update the issue with them.
---
### Author:  [@marko\_vranjkovic](https://discuss.elastic.co/u/marko_vranjkovic)
#### Post date: [December 19, 2019, 8:38am UTC](https://discuss.elastic.co/t/filebeat-cpu-utilization-metrics-are-not-normalized-by-default/210659/7 "2019-12-19T08:38:35Z")
@shaunak and @chrisronline
thanks a lot for your help and clarification!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 16, 2020, 10:38am UTC](https://discuss.elastic.co/t/filebeat-cpu-utilization-metrics-are-not-normalized-by-default/210659/8 "2020-01-16T10:38:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.