Grouping metrics by env

metricbeat.config.modules:
        path: ${path.config}/modules.d/*.yml
        reload.period: 10s
        reload.enabled: true
      metricbeat.max_start_delay: 10s
      setup.dashboards.enabled: true
      metricbeat.modules:
      - module: system
        metricsets:
          - cpu             # CPU usage
          - load            # CPU load averages
          - memory          # Memory usage
          - network         # Network IO
          - process         # Per process metrics
          - process_summary # Process summary
          - uptime          # System Uptime
          - socket_summary  # Socket summary
          #- core           # Per CPU core usage
          #- diskio         # Disk IO
          #- filesystem     # File system usage for each mountpoint
          #- fsstat         # File system summary metrics
          #- raid           # Raid
          #- socket         # Sockets and connection info (linux only)
          #- service        # systemd service information
        enabled: true
        period: 10s
        processes: ['.*']

        # Configure the mount point of the host’s filesystem for use in monitoring a host from within a container
        #hostfs: "/hostfs"

        # Configure the metric types that are included by these metricsets.
        cpu.metrics:  ["percentages","normalized_percentages"]  # The other available option is ticks.
        core.metrics: ["percentages"]

  
      cloud.id: "ELK_CLOUD_ID"
      cloud.auth: "ELK_CLOUD_AUTH"
      logging.to_files: true
      logging.files:
        # Configure the path where the logs are written. The default is the logs directory
        # under the home path (the binary location).
        path: /var/log/metricbeat
      name: 'my-application'
      fields:
        env: ELASTIC_APM_ENV
      processors:
        - add_host_metadata: ~
        - add_cloud_metadata: ~  

I have received instance information in kibana dashboard. i want to group instance by environment(dev,staging,prod) and check whole group CPU utilization and create alert