# System.load.norm.1 field exceeds 100%

**URL:** <https://discuss.elastic.co/t/system-load-norm-1-field-exceeds-100/147928>\
**Category:** Kibana\
**Created:** [September 10, 2018, 9:26am UTC](https://discuss.elastic.co/t/system-load-norm-1-field-exceeds-100/147928 "2018-09-10T09:26:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![TimoW](https://avatars.discourse-cdn.com/v4/letter/t/e495f1/32.png) [@TimoW](https://discuss.elastic.co/u/TimoW)\
**Post date:** [September 10, 2018, 9:26am UTC](https://discuss.elastic.co/t/system-load-norm-1-field-exceeds-100/147928/1 "2018-09-10T09:26:32Z")

</div>

Hey Everybody!

This is my first time posting to the forum, because I could not find any related threads.

I am using the Metricbeat to monitor different metrics concerning cluster health. One of which is the CPU usage for which I'm using the _ **system.load.norm.1** _ field.

Now I am wondering why values associated with this field still _ **exceed 100%** _ from time to time, if it clearly should not be the case for a normalized value.

Google searches as well as the Kibana docs did not present an answer to my question (at least I could not find any) so maybe there are some people around here who could clarify this behavior.

kind regards,  
Timo

---

<div class="post-metadata">

**Author:** ![Joe\_Fleming](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_fleming/32/3561_2.png) [@Joe\_Fleming](https://discuss.elastic.co/u/Joe_Fleming)\
**Post date:** [September 10, 2018, 7:03pm UTC](https://discuss.elastic.co/t/system-load-norm-1-field-exceeds-100/147928/2 "2018-09-10T19:03:33Z")

</div>

Those metric values are basically just the values from running `top`. The [metricbeat docs](https://www.elastic.co/guide/en/beats/metricbeat/master/exported-fields-system.html#_load_fields_2) explain that field as such:

```nohighlight
system.load.norm.1
type: scaled_float

Load for the last minute divided by the number of cores.

```

One interesting thing about `top` values is that they can, and regularly do, exceed 100%. This is explained on [this stackexchange post](https://unix.stackexchange.com/questions/34435/top-output-cpu-usage-100), which also mentions "Solaris mode", which sounds like what that field from metricbeat is showing.

So if you're seeing a value of 100%, and you have 4 cores, it means you have a load over 4.0 (`(load * 100) / # of cores`). You should be able to confirm that by looking at the value for `system.load.1`, the non-normalized "load average for the last minute" value.

---

<div class="post-metadata">

**Author:** ![TimoW](https://avatars.discourse-cdn.com/v4/letter/t/e495f1/32.png) [@TimoW](https://discuss.elastic.co/u/TimoW)\
**Post date:** [September 11, 2018, 8:15am UTC](https://discuss.elastic.co/t/system-load-norm-1-field-exceeds-100/147928/3 "2018-09-11T08:15:55Z")

</div>

I think I got the concept now after further reading, I did not know about that. So thanks for pointing me in the right direction Joe!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 9, 2018, 8:16am UTC](https://discuss.elastic.co/t/system-load-norm-1-field-exceeds-100/147928/4 "2018-10-09T08:16:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.