Timelion help

[kanthimathi]

In Timelion i wanted to visualise cpu usage per pod. I am using metricbeats for this purpose.

.es(index=metricbeat-*, timefield='@timestamp', metric='avg:system.cpu.user.pct').label('current hour').title('CPU usage over time').color(#1E90FF)

when i use the above syntax, it pulls the cpu usage but is it possible for me to get cpu usage per agent, I tried using this command

.es(index=metricbeat-*, timefield='@timestamp', kibana='beat.name:###',metric='avg:system.cpu.user.pct').label('current hour').title('CPU usage over time').color(#1E90FF)

But this is pulling result for general one and not getting the specified metrics alone. I want to find the usage for each pod in kubernetes. Can somebody help?

Thnaks,
Kanthi.

[kanthimathi]

I need to find the cpu usage in timelion for the past hour. I tried changing the above statement event with q='beat.name:###' but it is getting cpu usage for the entire system

[spalger (Spencer Alger)]

Using q=... to filter each series to a specific pod should totally work. This example uses randomly generated web logs, but does effectively the same thing. It's possible your query isn't actually working, are you able to verify the query works in Discover?

[kanthimathi]

This is the query I used. However, in discover i can find the hits. I tried both with beat.name and beat.hostname.

Update: Playing around I found that the query works with metric='count:system.cpu.user.pct' but not avg

.es(index=metricbeat-*, timefield='@timestamp', q="beat.hostname:k8s-agent-4CD4739E-24",metric='count:system.cpu.user.pct').label('current hour').title('CPU usage over time')

[spalger (Spencer Alger)]

Can you try filtering by the metricset name too? q="beat.hostname:k8s-agent-4CD4739E-24 AND metricset.name:cpu" including data from other metric sets might cause lines not to render because data is missing. You might also want to try .bars() instead of lines, or using the .fit() function to define how timelion should draw lines between points that have null values between them.

[kanthimathi]

works now Thank you