Timelion: Getting more than 100% for CPU usage


I'm using metricbeat to collect metricdata for a few debian servers. I've built the following chart in Timelion:

This is the query for it:

.es(metric=cardinality:system.process.cpu.total.pct).trim().movingaverage(5).label('cpu usage %'), .es(metric=cardinality:system.process.cpu.total.pct).trim().movingaverage(5).trend().label('Trend')

Can someone tell me why the yaxis is drawing graphs over 100%? How is that possible?

(alainc) #2

just an idea your cpu have more than one cpu core and it's a sum of multiple cpu core and not one by one.


You are almost right alainc: I found out that the graph is suming up data of 3 Servers. The reason is that the Host filter in the Kibana Dashboard is not working for a specific Host.... the filter is working for two hosts but not for the third one - have no idea why.

(Shota Ito) #4

Hi tomx1.

If you want to draw a CPU graph of a specific host, how about narrowing down to such with a query on the timelion side?

.es(metric=cardinality:system.process.cpu.total.pct,q=beat.hostname:'HOSTNAME').trim().movingaverage(5).label('cpu usage %'),

It may be good to display CPU utilization of all servers.

.es(metric=cardinality:system.process.cpu.total.pct,split=beat.hostname:5).trim().movingaverage(5).label(label='cpu usage % : ',regex='.*name.*:').label(label='',regex='>.*'),
.es(metric=cardinality:system.process.cpu.total.pct,split=beat.hostname:5).trim().movingaverage(5).trend().label(label='Trend : ',regex='.*name.*:').label(label='',regex='>.*')

I hope that information helps.


Thanks st1t, these are some really useful queries. But i stil think that there may exists a bug calculating these charts. I have used your Query to show the cpu usage of two Servers. Everything looks fine:

However, if i switch to 10 hours ago instead of 9 hours, the chart makes no sense anymore. As soon as i show more than the current day, timelion is summing up things here:

(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.