Running Metricbeat v6 RC1 (trialling the perfmon counter functionality), but have Metricbeat reporting metrics at a process level also, note I have "top n" selected as well as specifiying a few processes the idea was that I want the values for those processes in addition to any process that appears as a top 5 in memory or CPU:
#------------------------------- System Module ------------------------------- - module: system enabled: true period: 15s metricsets: - cpu # CPU usage #- load # CPU load averages (linux only) - memory # Memory usage - network # Network IO - process # Per process metrics - process_summary # Process summary #- core # Per CPU core usage - diskio # Disk IO #- socket # Sockets and connection info (linux only) processes: ['x1.exe', 'x2.exe', 'x3.exe', 'x4.exe', 'x5.exe', 'x6.exe', 'x7', 'x8.exe', 'x9.exe', 'x10.exe', 'x11.exe'] process.include_top_n: by_cpu: 5 # include top 5 processes by CPU by_memory: 5 # include top 5 processes by memory # Configure the metric types that are included by these metricsets. cpu.metrics: ["percentages"] # The other available options are normalized_percentages and ticks. # Configuring a less frequent disk monitor - module: system enabled: true period: 1m metricsets: - filesystem # File system usage for each mountpoint - fsstat # File system summary metrics
Have all the data in Elastic, and see the fields in Kibana (4.5.4)
Filtering Kibana by metricset.name:process I see about 20 entries per 15seconds,
filtering by the required system.process.cpu.total.pct and system.process.cpu.norm.pct metrics I see:
All looks good, now when I try and visualise this in Kibana it completely ignores the system.process.cpu.norm.pct and only provides a unusual system.process.cpu.total.pct (100%) value for a couple of the system.process.names.
If I view system.process.cpu.total.pct I see the expected block of 100% with Max Aggregation selected
Now if I break this down by process.name.raw I only get a couple of processes but with very strange values, especially the flat baseline of 100% (8 core system) for only 2 processes and everything seems to be in blocks of 100% and does not show the myriad of processes being monitored and the varied CPU values. I choose MAX aggregation as I want to see the real peaks.
If I select Average Value I see something that might be more plausible for an 8 core system but it only shows data for a few process names:
Note "the area may only contain partial data"
Maybe this is a problem with using "cpu.Total" on an 8 core system, so I try the normalised Field and get a blank screen even though the values are there!
By contrast the various "system.process.memory" metrics seem to display just fine whether using Average or Max aggregation:
Any idea what I'm doing wrong with the CPU stats?