TOP N processes (System process metrics)

Elastic Observability Metrics
2

Hi Fabian

Elastic Agent does not maintain a table for 60 seconds and then calculate the sum for all processes.

At every collection interval (in your example 60s), the System integration:
. Reads the CPU counters for all running processes from the OS.
. Calculates the CPU usage delta since the previous collection for each process.
. Normalizes the value by the number of CPU cores (system.process.cpu.total.norm.pct).
. Sorts the processes by CPU usage.
. Keeps and sends only the Top N processes (Top 15 in your example).

So the Top N selection happens at each collection cycle, based on the CPU usage between the last two samples, not on an accumulated table over the whole 60-second window.

1 Like