Timelion: Getting more than 100% for CPU usage

[tomx1]

I'm using metricbeat to collect metricdata for a few debian servers. I've built the following chart in Timelion:

This is the query for it:

.es(metric=cardinality:system.process.cpu.total.pct).trim().movingaverage(5).label('cpu usage %'), .es(metric=cardinality:system.process.cpu.total.pct).trim().movingaverage(5).trend().label('Trend')

Can someone tell me why the yaxis is drawing graphs over 100%? How is that possible?

[alainc]

just an idea your cpu have more than one cpu core and it's a sum of multiple cpu core and not one by one.

[tomx1]

You are almost right alainc: I found out that the graph is suming up data of 3 Servers. The reason is that the Host filter in the Kibana Dashboard is not working for a specific Host.... the filter is working for two hosts but not for the third one - have no idea why.

[st1t (Shota Ito)]

Hi tomx1.

If you want to draw a CPU graph of a specific host, how about narrowing down to such with a query on the timelion side?

.es(metric=cardinality:system.process.cpu.total.pct,q=beat.hostname:'HOSTNAME').trim().movingaverage(5).label('cpu usage %'),
.es(metric=cardinality:system.process.cpu.total.pct,q=beat.hostname:'HOSTNAME').trim().movingaverage(5).trend().label('Trend')

It may be good to display CPU utilization of all servers.

.es(metric=cardinality:system.process.cpu.total.pct,split=beat.hostname:5).trim().movingaverage(5).label(label='cpu usage % : ',regex='.*name.*:').label(label='',regex='>.*'),
.es(metric=cardinality:system.process.cpu.total.pct,split=beat.hostname:5).trim().movingaverage(5).trend().label(label='Trend : ',regex='.*name.*:').label(label='',regex='>.*')

I hope that information helps.

[tomx1]

Thanks st1t, these are some really useful queries. But i stil think that there may exists a bug calculating these charts. I have used your Query to show the cpu usage of two Servers. Everything looks fine:

However, if i switch to 10 hours ago instead of 9 hours, the chart makes no sense anymore. As soon as i show more than the current day, timelion is summing up things here: