Period system.cpu.total.pct versus system.cpu.total.norm.pct

Elastic Stack Beats
1

Hello
I have a metricbeat.yml file for system.cpu like

metricbeat.modules:
- module: system
  period: 150s
  metricsets:
    - cpu
    - load
    - memory
    - network
    - process
    - process_summary
  cpu.metrics: [percentages, normalized_percentages]
  enabled: true
  processes: ['.*']
  process.include_top_n:
    by_cpu: 5      # include top 5 processes by CPU
    by_memory: 5   # include top 5 processes by memory

The period is 150s. For system.cpu.total.pct I get values every 10 seconds. For system.cpu.total.norm.pct for 150s. Why this?

Thank you for your answer.

Manuel

system.cpu
system.cpu1343×627 46.6 KB

2

Hi @_Manuel Welcome to the community.

The modules.d/system.yml is enabled by default which is 10s period. So that is may be why you're seeing this. The yml files all get concatonated together and the system one gets catted on the end so those settings will be used.

So you should probably take those settings out of the metricbeat.yml and just set them in the modules.d/system.yml that is the normal method.

If you don't want to use the system.yml module then you need to disable it.

filebeat modules disable system

Make sure this is cleaned up and then we'll see if you see the same problem.

I'm also assuming that is only from one metricbeat that somehow you don't have one on one system configured one way and another on another system configured another way.

3

Hello Stephen
This is it! Thank you very much for your hint. I wasn't aware of system.yml. I'm just not shure if my changes in this file will be overwritten after an update of rpm metricbeat. I think I'll leave system.yml as it is. In fact I only need to have the additional value system.cpu.total.norm.pct. I think I will add the following line to my metricbeat.yml and remove all other module system lines because they are already in system.yml.

metricbeat.modules:
- module: system
  cpu.metrics: [percentages, normalized_percentages]

Is this the way I should do it?

Thank you for your answer.

Greetings Manuel

4

1st the modules.d/system.yml file will be treated like any other config file in the /etc/metricbeat directory for an RPM ... it should not be overwritten on update unless you direct the package to do that.

2nd I am a little confused what you are suggesting how you want to configure.

I would say whichever choice you make is to put either all the system metrics configuration in the modules.d/system.yml or metricbeat.yml I would strongly suggesting NOT putting some in each.

If I was recommending I would do all the system metrics configuration in the modules.d/system.yml file and keep the metricbeat.yml about the core metricbeat configuration, that is my preference.

5

Ok Stephen, thank you. I removed all modules from metricbeat.yml and added my line in system.yml. Works very well.

You helped me a lot.

Regards Manuel

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.