How to add two fields using Timelion?

[cchooks2 (Steven)]

Hello,

I am trying to add the values of system.cpu.system.pct & system.cpu.user.pct and get the total cpu usage for this particular server.

I have the following query:

(.es(index=metricbeat-*, q='beat.hostname:server1', timefield='@timestamp', metric='sum:system.cpu.system.pct').label(system.cpu.system.pct).multiply(100), .es(index=metricbeat-*, q='beat.hostname:server1', timefield='@timestamp', metric='sum:system.cpu.user.pct').multiply(100).label(system.cpu.user.pct))(.sum(.es()).label('Total CPU'))

I am expecting to see the total cpu usuage to be around 15% or so, but i am getting this huge graph of 1750000.

Actual values :

system.cpu.system.pct - 5.28%

system.cpu.user.pct - 0.101

Please see screenshots.

This graph shows the values for the two fields

This should be the result of adding the above fields.

Thanks for the help!

-Mock

[bhavyarm]

@thomasneirynck/@timroes any ideas?

Thanks,
Bhavya

[thomasneirynck]

hi @cchooks2,

That .sum looks to be in an odd spot.

@cchooks2

(.sum(.es()).label('Total CPU'))

You would do something like:

.es(...first-series..).sum(.es(...second-series....))

[timroes]

First let me ask: is there a specific reason, you are not simply visualizing the system.cpu.total.pct field instead?

The rest is as Thomas mentioned.

[cchooks2 (Steven)]

@thomasneirynck,

Thanks for the info ... my new query is:

 .es(index=metricbeat-*, q='beat.hostname:server1', timefield='@timestamp', metric='sum:system.cpu.system.pct').label(system.cpu.system.pct).multiply(100), .es(index=metricbeat-*, q='beat.hostname:server1', timefield='@timestamp', metric='sum:system.cpu.user.pct').label(system.cpu.user.pct).multiply(100), .es(index=metricbeat-*, q='beat.hostname:server1', timefield='@timestamp', metric='sum:system.cpu.system.pct').multiply(100).sum(.es(index=metricbeat-*, q='beat.hostname:server1', timefield='@timestamp', metric='sum:system.cpu.user.pct').multiply(100)).label('Total CPU')

Which is working now.

Thanks

[cchooks2 (Steven)]

@timroes,

So this system.cpu.total.pct field will give me the total cpu used? I do not see this field as part of the available fields. We are using Metricbeat 5.5.

Will I need to divide it by the number of cores i have to get the actual cpu usage?

Thanks.

[timroes]

Hi Steven,

yeah that metric wasn't available in 5.5, but is available in more recent versions.

You can divide by the number of cores if you want a number between 0 to 100%, but I would say the actual CPU usage in a unix world is specified as 0.0 to 4.0 (if you have 4 cores). So I would totally get what 2.6 (or 260%) means if I see that, but that might be depending on your personal preferences

Cheers,
Tim