Getting aggregated view of 100% CPU across all dashboard views for windows server

(Mahesh M) #1


We have been trying to achieve a breakdown of the active CPU% distributed between all the active process. Here's an example: If we have 8CPU, we see the total will be 800% and the active process consumption goes above 100% which is not ideal.

Question about Question about says that windows is a discrepancy where metricbeat is not accurate.


Please help/clarify if this can be sorted.


(Andrew Kroh) #2

The post you linked to is kind of old. I believe that since then we made some changes. The value ranges on 0 to 100%. You should be able to verify that by look at the individual events in a non-aggregated view (Discover tab) and doing a Lucene query like>=1.

What version of Metricbeat is being used?

(Mahesh M) #3

Thanks AndreW. It is metricbeat 6.2.1 and still is going beyond 100%. Is there a possible way to put a calculation ( to get accurate values? Is should be considered for this? And, system.cpu.system.pct measure for?

(Andrew Kroh) #4

I would consider it a bug if the normalized CPU metrics are going over 100%. Can you please open a bug report on Github for this issue and include a raw event in JSON form (you can grab that from Kibana's Discover page).

As a workaround, yes, it's definitely possible to do your own calculations. There is a system.cpu.cores metric which contains the total number of cores. With that value I think you should be able to do your own calculation.

You can do the calculation either at ingest time by using Logstash. Or you can add a scripted field to Kibana.

This is a filter example in LS that shows how you can do a calculation. (I'm not sure these calculations are relevant -- I just copied it from somewhere to demonstrate how it can be done.)

filter {
  ruby {
    code => "
      event.set('[system][cpu][total][norm][pct]', 1 - (event.get('[system][cpu][idle][pct]') / event.get('[system][cpu][cores]') ))
      event.set('[system][cpu][total][pct]', event.get('[system][cpu][total][norm][pct]') * event.get('[system][cpu][cores]') )

(Mahesh M) #5

Thanks Andrew, I see the normalized CPU is defined only for process by CPU. However, I wanted to understand if there is any defined normalized CPU for system/server?


(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.