- Elastic integrations
- Integrations quick reference
- 1Password
- Abnormal Security
- ActiveMQ
- Active Directory Entity Analytics
- Airflow
- Akamai
- Apache
- API (custom)
- Arbor Peakflow SP Logs
- Arista NG Firewall
- Atlassian
- Auditd
- Auth0
- authentik
- AWS
- Amazon CloudFront
- Amazon DynamoDB
- Amazon EBS
- Amazon EC2
- Amazon ECS
- Amazon EMR
- AWS API Gateway
- Amazon GuardDuty
- AWS Health
- Amazon Kinesis Data Firehose
- Amazon Kinesis Data Stream
- Amazon Managed Streaming for Apache Kafka (MSK)
- Amazon NAT Gateway
- Amazon RDS
- Amazon Redshift
- Amazon S3
- Amazon S3 Storage Lens
- Amazon Security Lake
- Amazon SNS
- Amazon SQS
- Amazon VPC
- Amazon VPN
- AWS Bedrock
- AWS Billing
- AWS CloudTrail
- AWS CloudWatch
- AWS ELB
- AWS Fargate
- AWS Inspector
- AWS Lambda
- AWS Logs (custom)
- AWS Network Firewall
- AWS Route 53
- AWS Security Hub
- AWS Transit Gateway
- AWS Usage
- AWS WAF
- Azure
- Activity logs
- App Service
- Application Gateway
- Application Insights metrics
- Application Insights metrics overview
- Application State Insights metrics
- Azure logs (v2 preview)
- Azure OpenAI
- Billing metrics
- Container instance metrics
- Container registry metrics
- Container service metrics
- Custom Azure Logs
- Custom Blob Storage Input
- Database Account metrics
- Event Hub input
- Firewall logs
- Frontdoor
- Functions
- Microsoft Entra ID
- Monitor metrics
- Network Watcher VNet
- Network Watcher NSG
- Platform logs
- Resource metrics
- Spring Cloud logs
- Storage Account metrics
- Virtual machines metrics
- Virtual machines scaleset metrics
- Barracuda
- BeyondInsight and Password Safe Integration
- BitDefender
- Bitwarden
- blacklens.io
- Blue Coat Director Logs
- BBOT (Bighuge BLS OSINT Tool)
- Box Events
- Bravura Monitor
- Broadcom ProxySG
- Canva
- Cassandra
- CEL Custom API
- Ceph
- Check Point
- Cilium Tetragon
- CISA Known Exploited Vulnerabilities
- Cisco
- Cisco Meraki Metrics
- Citrix
- Claroty CTD
- Cloudflare
- Cloud Asset Inventory
- CockroachDB Metrics
- Common Event Format (CEF)
- Containerd
- CoreDNS
- Corelight
- Couchbase
- CouchDB
- Cribl
- CrowdStrike
- Cyberark
- Cybereason
- CylanceProtect Logs
- Custom Websocket logs
- Darktrace
- Data Exfiltration Detection
- DGA
- Digital Guardian
- Docker
- DomainTools Real Time Unified Feeds
- Elastic APM
- Elastic Fleet Server
- Elastic Security
- Elastic Stack monitoring
- Elasticsearch Service Billing
- Envoy Proxy
- ESET PROTECT
- ESET Threat Intelligence
- etcd
- Falco
- F5
- File Integrity Monitoring
- FireEye Network Security
- First EPSS
- Forcepoint Web Security
- ForgeRock
- Fortinet
- Gigamon
- GitHub
- GitLab
- Golang
- Google Cloud
- Custom GCS Input
- GCP
- GCP Audit logs
- GCP Billing metrics
- GCP Cloud Run metrics
- GCP CloudSQL metrics
- GCP Compute metrics
- GCP Dataproc metrics
- GCP DNS logs
- GCP Firestore metrics
- GCP Firewall logs
- GCP GKE metrics
- GCP Load Balancing metrics
- GCP Metrics Input
- GCP PubSub logs (custom)
- GCP PubSub metrics
- GCP Redis metrics
- GCP Security Command Center
- GCP Storage metrics
- GCP VPC Flow logs
- GCP Vertex AI
- GoFlow2 logs
- Hadoop
- HAProxy
- Hashicorp Vault
- HTTP Endpoint logs (custom)
- IBM MQ
- IIS
- Imperva
- InfluxDb
- Infoblox
- Iptables
- Istio
- Jamf Compliance Reporter
- Jamf Pro
- Jamf Protect
- Jolokia Input
- Journald logs (custom)
- JumpCloud
- Kafka
- Keycloak
- Kubernetes
- LastPass
- Lateral Movement Detection
- Linux Metrics
- Living off the Land Attack Detection
- Logs (custom)
- Lumos
- Lyve Cloud
- Mattermost
- Memcached
- Menlo Security
- Microsoft
- Microsoft 365
- Microsoft Defender for Cloud
- Microsoft Defender for Endpoint
- Microsoft DHCP
- Microsoft DNS Server
- Microsoft Entra ID Entity Analytics
- Microsoft Exchange Online Message Trace
- Microsoft Exchange Server
- Microsoft Graph Activity Logs
- Microsoft M365 Defender
- Microsoft Office 365 Metrics Integration
- Microsoft Sentinel
- Microsoft SQL Server
- Mimecast
- ModSecurity Audit
- MongoDB
- MongoDB Atlas
- MySQL
- Nagios XI
- NATS
- NetFlow Records
- Netskope
- Network Beaconing Identification
- Network Packet Capture
- Nginx
- Okta
- Oracle
- OpenAI
- OpenCanary
- Osquery
- Palo Alto
- pfSense
- PHP-FPM
- PingOne
- PingFederate
- Pleasant Password Server
- PostgreSQL
- Prometheus
- Proofpoint TAP
- Proofpoint On Demand
- Pulse Connect Secure
- Qualys VMDR
- QNAP NAS
- RabbitMQ Logs
- Radware DefensePro Logs
- Rapid7
- Redis
- Rubrik RSC Metrics Integration
- Sailpoint Identity Security Cloud
- Salesforce
- SentinelOne
- ServiceNow
- Slack Logs
- Snort
- Snyk
- SonicWall Firewall
- Sophos
- Spring Boot
- SpyCloud Enterprise Protection
- SQL Input
- Squid Logs
- SRX
- STAN
- Statsd Input
- Sublime Security
- Suricata
- StormShield SNS
- Symantec
- Symantec Endpoint Security
- Sysmon for Linux
- Sysdig
- Syslog Router Integration
- System
- System Audit
- Tanium
- TCP Logs (custom)
- Teleport
- Tenable
- Threat intelligence
- ThreatConnect
- Threat Map
- Thycotic Secret Server
- Tines
- Traefik
- Trellix
- Trend Micro
- TYCHON Agentless
- UDP Logs (custom)
- Universal Profiling
- Vectra Detect
- VMware
- WatchGuard Firebox
- WebSphere Application Server
- Windows
- Wiz
- Zeek
- ZeroFox
- Zero Networks
- ZooKeeper Metrics
- Zoom
- Zscaler
Rubrik RSC Metrics Integration
editRubrik RSC Metrics Integration
editVersion |
0.4.0 [beta] This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. (View all) |
Compatible Kibana version(s) |
8.16.0 or higher |
Supported Serverless project types |
Security |
Subscription level |
Basic |
Level of support |
Elastic |
This integration periodically fetches metrics from Rubrik GraphQL API. It collects a wide range of metrics including virtual machines, filesets, volumes, node statistics, and drives performance.
These metrics help you understand how to properly manage your Rubrik infrastructure.
Compatibility
editThe integration uses the HTTP JSON input to collect metrics from Rubrik APIs.
Requirements
editYou need Elasticsearch for storing and searching your data and Kibana for visualizing and managing it. You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, or self-manage the Elastic Stack on your own hardware.
Configuration
editTo configure this integration in Elastic, you need the following information:
- Hostname
- Client ID
- Client Secret
- Token URL
For more details on these settings, refer to the Rubrik official documentation.
Enabling the integration in Elastic
edit- In Kibana, navigate to Management > Integrations
- In the "Search for integrations" search bar, type Rubrik
- Click on "Rubrik RSC Metrics" integration from the search results
- Click on the Add Rubrik RSC Metrics Integration button to add the integration
Metrics
editManaged Volumes
editThe managed_volumes
dataset provides metrics related to the health and status of managed volumes.
ECS Field Reference
Please refer to the following document for detailed information on ECS fields.
Exported fields
Field | Description | Type | Unit | Metric Type |
---|---|---|---|---|
@timestamp |
Event timestamp. |
date |
||
data_stream.dataset |
Data stream dataset. |
constant_keyword |
||
data_stream.namespace |
Data stream namespace. |
constant_keyword |
||
data_stream.type |
Data stream type. |
constant_keyword |
||
rubrik.cluster.id |
The cluster UUID. |
keyword |
||
rubrik.cluster.name |
The cluster name. |
keyword |
||
rubrik.effective_sla_domain.id |
The ID of the SLA domain. |
keyword |
||
rubrik.effective_sla_domain.name |
The name of the SLA domain. |
keyword |
||
rubrik.managed_volumes.free_size.bytes |
Free capacity for the volume across all the channels, in bytes. |
long |
byte |
gauge |
rubrik.managed_volumes.name |
The name of the Managed Volume. |
keyword |
||
rubrik.managed_volumes.num_channels.count |
Number of channels to divide the volume into. Each channel provides a unique share to write to. |
long |
gauge |
|
rubrik.managed_volumes.pending_snapshots.count |
The total number of snapshots present for the workload. |
long |
gauge |
|
rubrik.managed_volumes.state |
State of managed volume. |
keyword |
||
rubrik.managed_volumes.total_snapshots.count |
The total number of snapshots present for the workload. |
long |
gauge |
|
rubrik.managed_volumes.used_size.bytes |
Used capacity for the volume across all the channels, in bytes. |
long |
byte |
gauge |
rubrik.managed_volumes.volume_size.bytes |
Maximum capacity for the volume across all the channels, in bytes. |
long |
byte |
gauge |
Example
An example event for managed_volumes
looks as following:
{ "agent": { "name": "docker-fleet-agent", "id": "9f7dc10d-9fe5-4bc8-98ce-d4cb4661e04c", "ephemeral_id": "bc7df02b-35f9-477e-94c6-0e09c44c0b9c", "type": "filebeat", "version": "8.16.0" }, "rubrik": { "cluster": { "name": "cluster-1", "id": "7562f3f9-f7ff-4828-af2c-87df3bf4f54c" }, "effective_sla_domain": { "id": "4031c11d-078e-4f14-8566-717cfffaf359", "name": "sla-domain-1" }, "managed_volumes": { "num_channels": { "count": 1 }, "total_snapshots": { "count": 0 }, "name": "volume-1", "pending_snapshots": { "count": 0 }, "volume_size": { "bytes": 1073741824 }, "state": "MANAGED_VOLUME_STATE_EXPORTED", "used_size": { "bytes": 24576 }, "free_size": { "bytes": 1073717248 } } }, "@timestamp": "2025-01-16T20:40:02.299Z", "ecs": { "version": "8.16.0" }, "data_stream": { "namespace": "default", "type": "logs", "dataset": "rubrik.managed_volumes" }, "host": { "hostname": "docker-fleet-agent", "os": { "kernel": "6.8.0-51-generic", "name": "Wolfi", "family": "", "type": "linux", "version": "20230201", "platform": "wolfi" }, "ip": [ "172.18.0.4" ], "containerized": false, "name": "docker-fleet-agent", "mac": [ "02-42-AC-12-00-04" ], "architecture": "x86_64" }, "elastic_agent": { "id": "9f7dc10d-9fe5-4bc8-98ce-d4cb4661e04c", "version": "8.16.0", "snapshot": false }, "event": { "agent_id_status": "verified", "ingested": "2025-01-16T20:40:03Z", "kind": "metric", "dataset": "rubrik.managed_volumes" }, "tags": [ "rubrik.managed_volumes" ] }
Monitoring Jobs
editThe monitoring_jobs
dataset provides metrics related to the series of activities on either the RSC or a Rubrik cluster.
ECS Field Reference
Please refer to the following document for detailed information on ECS fields.
Exported fields
Field | Description | Type | Metric Type |
---|---|---|---|
@timestamp |
Event timestamp. |
date |
|
data_stream.dataset |
Data stream dataset. |
constant_keyword |
|
data_stream.namespace |
Data stream namespace. |
constant_keyword |
|
data_stream.type |
Data stream type. |
constant_keyword |
|
rubrik.cluster.id |
The cluster UUID. |
keyword |
|
rubrik.cluster.name |
The cluster name. |
keyword |
|
rubrik.monitoring_jobs.all_jobs.count |
The total count of all jobs. |
long |
gauge |
rubrik.monitoring_jobs.archive_jobs.count |
The total count of all archive jobs. |
long |
gauge |
rubrik.monitoring_jobs.backup_jobs.count |
The total count of all backup jobs. |
long |
gauge |
rubrik.monitoring_jobs.conversion_jobs.count |
The total count of all conversion jobs. |
long |
gauge |
rubrik.monitoring_jobs.log_backup_jobs.count |
The total count of all log backup jobs. |
long |
gauge |
rubrik.monitoring_jobs.recovery_jobs.count |
The total count of all recovery jobs. |
long |
gauge |
rubrik.monitoring_jobs.replication_jobs.count |
The total count of all replication jobs. |
long |
gauge |
Example
An example event for monitoring_jobs
looks as following:
{ "agent": { "name": "ip-172-31-39-96.eu-north-1.compute.internal", "id": "7c37e065-93e1-4e86-a2c9-ee166c4eccbb", "type": "filebeat", "ephemeral_id": "7a656a0d-e5cc-4f70-9528-8d1338cfe3b8", "version": "8.13.2" }, "rubrik": { "cluster": { "id": "52688802-aefd-4dee-9992-1e0c0623b54f", "name": "cluster-1" }, "monitoring_jobs": { "log_backup_jobs": { "count": 0 }, "replication_jobs": { "count": 6 }, "recovery_jobs": { "count": 39 }, "archive_jobs": { "count": 8 }, "backup_jobs": { "count": 36092 }, "conversion_jobs": { "count": 0 }, "all_jobs": { "count": 668241 } } }, "@timestamp": "2025-01-07T17:22:42.912Z", "ecs": { "version": "8.16.0" }, "data_stream": { "namespace": "default", "type": "metrics", "dataset": "rubrik.monitoring_jobs" }, "elastic_agent": { "id": "7c37e065-93e1-4e86-a2c9-ee166c4eccbb", "version": "8.13.2", "snapshot": false }, "host": { "hostname": "ip-172-31-39-96.eu-north-1.compute.internal", "os": { "kernel": "6.1.82-99.168.amzn2023.x86_64", "codename": "Amazon Linux", "name": "Amazon Linux", "type": "linux", "family": "redhat", "version": "2023", "platform": "amzn" }, "containerized": false, "ip": [ "172.31.39.96", "fe80::88f:89ff:fea6:2561", "172.17.0.1", "fe80::42:77ff:fe00:bad7", "172.18.0.1", "fe80::42:ff:fe6c:4aef", "fe80::1803:deff:fef6:6cf3", "172.19.0.1", "fe80::42:dff:fed2:b9a9", "fe80::54a9:a8ff:feb8:2d8d" ], "name": "ip-172-31-39-96.eu-north-1.compute.internal", "id": "ec2130e5d5c423ed85ac1c1a0b96beeb", "mac": [ "02-42-00-6C-4A-EF", "02-42-0D-D2-B9-A9", "02-42-77-00-BA-D7", "0A-8F-89-A6-25-61", "1A-03-DE-F6-6C-F3", "56-A9-A8-B8-2D-8D" ], "architecture": "x86_64" }, "event": { "agent_id_status": "verified", "ingested": "2025-01-07T17:22:53Z", "original": "{\"allJobs\":668241,\"archiveJobs\":{\"count\":8},\"backupJobs\":{\"count\":36092},\"conversionJobs\":{\"count\":0},\"id\":\"7f4f96b3-e777-4bde-ba08-47a40ecaa416\",\"logBackupJobs\":{\"count\":0},\"name\":\"401-rubrik\",\"recoveryJobs\":{\"count\":39},\"replicationJobs\":{\"count\":6}}", "created": "2025-01-07T17:22:42.912Z", "kind": "metric", "dataset": "rubrik.monitoring_jobs" }, "tags": [ "preserve_original_event" ] }
Virtual Machines
editThe virtualmachines
dataset provides metrics related to the state of the virtual machines.
ECS Field Reference
Please refer to the following document for detailed information on ECS fields.
Exported fields
Field | Description | Type |
---|---|---|
@timestamp |
Event timestamp. |
date |
data_stream.dataset |
Data stream dataset. |
constant_keyword |
data_stream.namespace |
Data stream namespace. |
constant_keyword |
data_stream.type |
Data stream type. |
constant_keyword |
rubrik.cluster.id |
The cluster UUID. |
keyword |
rubrik.cluster.name |
The cluster name. |
keyword |
rubrik.effective_sla_domain.id |
The ID of the SLA domain. |
keyword |
rubrik.effective_sla_domain.name |
The name of the SLA domain. |
keyword |
rubrik.virtual_machines.agent_status |
The status of the Rubrik Backup Service agent for virtual machines. Supported in v5.0+. |
keyword |
rubrik.virtual_machines.id |
The object ID. |
keyword |
rubrik.virtual_machines.name |
The name of the hierarchy object. |
keyword |
rubrik.virtual_machines.power_status |
The power status of VM (ON,OFF,SLEEP etc.). Supported in v5.0+. |
keyword |
Example
An example event for virtual_machines
looks as following:
{ "agent": { "name": "docker-fleet-agent", "id": "e74cda94-80b2-42d7-a508-21885a2614b5", "type": "filebeat", "ephemeral_id": "091ede6d-809e-4d2e-9f21-33187c53b7d4", "version": "8.16.0" }, "rubrik": { "cluster": { "name": "cluster-1", "id": "7562f3f9-f7ff-4828-af2c-87df3bf4f54c" }, "effective_sla_domain": { "id": "4031c11d-078e-4f14-8566-717cfffaf359", "name": "sla-domain-1" }, "virtual_machines": { "agent_status": "UNREGISTERED", "power_status": "POWERED_OFF", "name": "dashboard01", "id": "25842075-fd83-4c75-8709-310166ef792d" } }, "@timestamp": "2025-01-08T13:08:18.698Z", "ecs": { "version": "8.16.0" }, "data_stream": { "namespace": "default", "type": "metrics", "dataset": "rubrik.virtual_machines" }, "elastic_agent": { "id": "e74cda94-80b2-42d7-a508-21885a2614b5", "version": "8.16.0", "snapshot": false }, "host": { "hostname": "docker-fleet-agent", "os": { "kernel": "6.8.0-51-generic", "name": "Wolfi", "type": "linux", "version": "20230201", "platform": "wolfi" }, "containerized": false, "ip": [ "172.18.0.7" ], "name": "docker-fleet-agent", "mac": [ "02-42-AC-12-00-07" ], "architecture": "x86_64" }, "event": { "agent_id_status": "verified", "ingested": "2025-01-08T13:08:19Z", "created": "2025-01-08T13:08:18.698Z", "kind": "metric", "dataset": "rubrik.virtual_machines" } }
Filesets
editThe filesets
dataset provides metrics related to the state of the filesets.
ECS Field Reference
Please refer to the following document for detailed information on ECS fields.
Exported fields
Field | Description | Type | Unit | Metric Type |
---|---|---|---|---|
@timestamp |
Event timestamp. |
date |
||
data_stream.dataset |
Data stream dataset. |
constant_keyword |
||
data_stream.namespace |
Data stream namespace. |
constant_keyword |
||
data_stream.type |
Data stream type. |
constant_keyword |
||
rubrik.cluster.id |
The cluster UUID. |
keyword |
||
rubrik.cluster.name |
The cluster name. |
keyword |
||
rubrik.effective_sla_domain.id |
The ID of the SLA domain. |
keyword |
||
rubrik.effective_sla_domain.name |
The name of the SLA domain. |
keyword |
||
rubrik.fileset.archive_snapshots.count |
The number of snapshots that have been archived. |
long |
gauge |
|
rubrik.fileset.archive_storage.bytes |
The amount of storage used by archived snapshots. |
long |
byte |
gauge |
rubrik.fileset.compliance_status |
The current compliance status of the workload. |
keyword |
||
rubrik.fileset.host_os_type |
The operating system type of the host. |
keyword |
||
rubrik.fileset.local_storage.bytes |
The local storage size in bytes. |
long |
byte |
gauge |
rubrik.fileset.name |
The name of the Fileset. |
keyword |
||
rubrik.fileset.total_snapshots.count |
The total number of snapshots present for the workload. |
long |
gauge |
Example
An example event for filesets
looks as following:
{ "agent": { "name": "ip-172-31-39-96", "id": "7c37e065-93e1-4e86-a2c9-ee166c4eccbb", "type": "filebeat", "ephemeral_id": "e897b559-c04a-471f-ba91-b2e6b84a5a3c", "version": "8.13.2" }, "rubrik": { "cluster": { "name": "401-rubrik", "id": "7f4f96b3-e777-4bde-ba08-47a40ecaa416" }, "effective_sla_domain": { "name": "2 day", "id": "1efe5fa8-d97f-5067-afcc-e02525ad0a4e" }, "fileset": { "archive_snapshots": { "count": 0 }, "total_snapshots": { "count": 6 }, "local_storage": { "bytes": 1286184885 }, "name": "Linux", "host_os_type": "LINUX", "archive_storage": { "bytes": 0 }, "compliance_status": "OUT_OF_COMPLIANCE" } }, "@timestamp": "2025-01-16T07:23:59.158Z", "ecs": { "version": "8.16.0" }, "data_stream": { "namespace": "default", "type": "metrics", "dataset": "rubrik.filesets" }, "elastic_agent": { "id": "7c37e065-93e1-4e86-a2c9-ee166c4eccbb", "version": "8.13.2", "snapshot": false }, "host": { "hostname": "ip-172-31-39-96", "os": { "kernel": "6.1.82-99.168.amzn2023.x86_64", "codename": "Amazon Linux", "name": "Amazon Linux", "type": "linux", "family": "redhat", "version": "2023", "platform": "amzn" }, "containerized": false, "ip": [ "172.31.39.96", "fe80::88f:89ff:fea6:2561", "172.17.0.1", "fe80::42:77ff:fe00:bad7", "172.18.0.1", "fe80::42:ff:fe6c:4aef", "fe80::1803:deff:fef6:6cf3", "172.19.0.1", "fe80::42:dff:fed2:b9a9", "fe80::54a9:a8ff:feb8:2d8d" ], "name": "ip-172-31-39-96", "id": "ec2130e5d5c423ed85ac1c1a0b96beeb", "mac": [ "02-42-00-6C-4A-EF", "02-42-0D-D2-B9-A9", "02-42-77-00-BA-D7", "0A-8F-89-A6-25-61", "1A-03-DE-F6-6C-F3", "56-A9-A8-B8-2D-8D" ], "architecture": "x86_64" }, "event": { "agent_id_status": "verified", "ingested": "2025-01-16T21:07:16Z", "original": "{\"archiveSnapshots\":0,\"archiveStorage\":0,\"clusterID\":\"7f4f96b3-e777-4bde-ba08-47a40ecaa416\",\"clusterName\":\"401-rubrik\",\"complianceStatus\":\"OUT_OF_COMPLIANCE\",\"effectiveSlaDomainID\":\"1efe5fa8-d97f-5067-afcc-e02525ad0a4e\",\"effectiveSlaDomainName\":\"2 day\",\"filesetName\":\"Linux\",\"localStorage\":1286184885,\"osType\":\"LINUX\",\"totalSnapshots\":6}", "kind": "metric", "dataset": "rubrik.filesets" }, "tags": [ "preserve_original_event", "rubrik.filesets" ] }
Drives
editThe drives
dataset provides metrics related to the state of the drives.
ECS Field Reference
Please refer to the following document for detailed information on ECS fields.
Exported fields
Field | Description | Type | Unit | Metric Type |
---|---|---|---|---|
@timestamp |
Event timestamp. |
date |
||
data_stream.dataset |
Data stream dataset. |
constant_keyword |
||
data_stream.namespace |
Data stream namespace. |
constant_keyword |
||
data_stream.type |
Data stream type. |
constant_keyword |
||
rubrik.cluster.id |
The cluster UUID. |
keyword |
||
rubrik.cluster.name |
The cluster name. |
keyword |
||
rubrik.drives.capacity.bytes |
Disk capacity, in bytes. |
long |
byte |
gauge |
rubrik.drives.id |
ID of the Rubrik cluster disk type. |
keyword |
||
rubrik.drives.is_encrypted |
Specifies if the disk is encrypted. |
boolean |
||
rubrik.drives.node_id |
ID of the Rubrik cluster node. |
keyword |
||
rubrik.drives.path |
Disk path. |
keyword |
||
rubrik.drives.status |
Represents cluster’s knowledge of a disk state. |
keyword |
||
rubrik.drives.type |
Disk type. |
keyword |
||
rubrik.drives.unallocated.bytes |
Disk unallocated bytes. |
long |
byte |
gauge |
rubrik.drives.usable.bytes |
Disk usable bytes. |
long |
byte |
gauge |
Example
An example event for drives
looks as following:
{ "agent": { "name": "docker-fleet-agent", "id": "a35969d5-ae9b-49a1-87f2-cbc521f2989a", "type": "filebeat", "ephemeral_id": "e77b39f7-c984-4d5a-ae7e-dba3567aab2f", "version": "8.16.0" }, "rubrik": { "cluster": { "name": "cluster-1", "id": "acbd69a0-64d3-4a34-a83e-c4ecddcd34b8" }, "drives": { "path": "/mnt/wwn-0x4123a4004a3612c7", "usable": { "bytes": 1452177072128 }, "unallocated": { "bytes": 1492201697280 }, "is_encrypted": false, "id": "sdd", "node_id": "1f7c2a2a-8631-416d-abfb-0ab97c2e0fd0", "type": "HDD", "status": "ACTIVE", "capacity": { "bytes": 3834792386560 } } }, "@timestamp": "2025-01-15T17:26:20.012Z", "ecs": { "version": "8.16.0" }, "data_stream": { "namespace": "default", "type": "metrics", "dataset": "rubrik.drives" }, "elastic_agent": { "id": "a35969d5-ae9b-49a1-87f2-cbc521f2989a", "version": "8.16.0", "snapshot": false }, "host": { "hostname": "docker-fleet-agent", "os": { "kernel": "6.8.0-51-generic", "name": "Wolfi", "type": "linux", "version": "20230201", "platform": "wolfi" }, "containerized": false, "ip": [ "172.18.0.7" ], "name": "docker-fleet-agent", "mac": [ "02-42-AC-12-00-07" ], "architecture": "x86_64" }, "event": { "agent_id_status": "verified", "ingested": "2025-01-15T17:26:21Z", "created": "2025-01-15T17:26:20.012Z", "kind": "metric", "dataset": "rubrik.drives" } }
Physical Hosts
editThe physical_hosts
dataset provides metrics related to the state of the physical hosts.
ECS Field Reference
Please refer to the following document for detailed information on ECS fields.
Exported fields
Field | Description | Type |
---|---|---|
@timestamp |
Event timestamp. |
date |
data_stream.dataset |
Data stream dataset. |
constant_keyword |
data_stream.namespace |
Data stream namespace. |
constant_keyword |
data_stream.type |
Data stream type. |
constant_keyword |
rubrik.cluster.id |
The cluster UUID. |
keyword |
rubrik.cluster.name |
The cluster name. |
keyword |
rubrik.effective_sla_domain.id |
The ID of the SLA domain. |
keyword |
rubrik.effective_sla_domain.name |
The name of the SLA domain. |
keyword |
rubrik.physical_hosts.connectivity_status |
Connectivity status of host. |
keyword |
rubrik.physical_hosts.id |
ID of the physical host. |
keyword |
rubrik.physical_hosts.name |
Name of the physical host. |
keyword |
rubrik.physical_hosts.os_type |
The operating system type of the physical host. |
keyword |
Example
An example event for physical_hosts
looks as following:
{ "agent": { "name": "docker-fleet-agent", "id": "0aae3c7e-885b-4e49-9419-379e87197012", "ephemeral_id": "3a87f3c5-7e6f-412c-8b8b-ec856a732f8a", "type": "filebeat", "version": "8.16.0" }, "rubrik": { "cluster": { "name": "cluster-1", "id": "7562f3f9-f7ff-4828-af2c-87df3bf4f54c" }, "effective_sla_domain": { "id": "4031c11d-078e-4f14-8566-717cfffaf359", "name": "sla-domain-1" }, "physical_hosts": { "connectivity_status": "DISCONNECTED", "os_type": "WINDOWS", "name": "0.0.0.0", "id": "aed47d37-4267-4b15-9a4c-be41c215cb52" } }, "@timestamp": "2025-01-09T18:54:45.445Z", "ecs": { "version": "8.16.0" }, "data_stream": { "namespace": "default", "type": "metrics", "dataset": "rubrik.physical_hosts" }, "elastic_agent": { "id": "0aae3c7e-885b-4e49-9419-379e87197012", "version": "8.16.0", "snapshot": false }, "host": { "hostname": "docker-fleet-agent", "os": { "kernel": "6.8.0-51-generic", "name": "Wolfi", "type": "linux", "version": "20230201", "platform": "wolfi" }, "ip": [ "172.18.0.7" ], "containerized": false, "name": "docker-fleet-agent", "mac": [ "02-42-AC-12-00-07" ], "architecture": "x86_64" }, "event": { "agent_id_status": "verified", "ingested": "2025-01-09T18:54:46Z", "kind": "metric", "dataset": "rubrik.physical_hosts" }, "tags": [ "rubrik.physical_hosts" ] }
MSSQL Databases
editThe mssql_databases
dataset provides metrics related to the state of the MSSQL databases.
ECS Field Reference
Please refer to the following document for detailed information on ECS fields.
Exported fields
Field | Description | Type |
---|---|---|
@timestamp |
Event timestamp. |
date |
data_stream.dataset |
Data stream dataset. |
constant_keyword |
data_stream.namespace |
Data stream namespace. |
constant_keyword |
data_stream.type |
Data stream type. |
constant_keyword |
rubrik.cluster.id |
The cluster UUID. |
keyword |
rubrik.cluster.name |
The cluster name. |
keyword |
rubrik.effective_sla_domain.id |
The ID of the SLA domain. |
keyword |
rubrik.effective_sla_domain.name |
The name of the SLA domain. |
keyword |
rubrik.mssql_databases.id |
ID of the database. |
keyword |
rubrik.mssql_databases.is_online |
Specifies if the SQL Server database is online. |
boolean |
rubrik.mssql_databases.missed_snapshots.count |
Number of missed snapshots. |
long |
rubrik.mssql_databases.name |
Name of the database. |
keyword |
Example
An example event for mssql_databases
looks as following:
{ "agent": { "name": "docker-fleet-agent", "id": "19728c71-8995-495f-acbd-ab53d6a60f02", "type": "filebeat", "ephemeral_id": "f7b08e7b-5b53-4ee4-b651-ebee08783840", "version": "8.16.0" }, "rubrik": { "cluster": { "name": "cluster-1", "id": "f5ce5ffc-42d4-47bc-a64f-d928030892d5" }, "effective_sla_domain": { "id": "4031c11d-078e-4f14-8566-717cfffaf359", "name": "sla-domain-1" }, "mssql_databases": { "name": "name-1", "id": "2abed6ca-bbf7-42df-a402-2166a7abebd0", "is_online": true } }, "@timestamp": "2025-01-15T13:32:41.191Z", "ecs": { "version": "8.16.0" }, "data_stream": { "namespace": "default", "type": "metrics", "dataset": "rubrik.mssql_databases" }, "elastic_agent": { "id": "19728c71-8995-495f-acbd-ab53d6a60f02", "version": "8.16.0", "snapshot": false }, "host": { "hostname": "docker-fleet-agent", "os": { "kernel": "6.8.0-51-generic", "name": "Wolfi", "type": "linux", "version": "20230201", "platform": "wolfi" }, "ip": [ "172.18.0.7" ], "containerized": false, "name": "docker-fleet-agent", "mac": [ "02-42-AC-12-00-07" ], "architecture": "x86_64" }, "event": { "agent_id_status": "verified", "ingested": "2025-01-15T13:32:42Z", "created": "2025-01-15T13:32:41.191Z", "kind": "metric", "dataset": "rubrik.mssql_databases" } }
Tasks
editThe tasks
dataset provides metrics related to the state of Rubrik backup and object protection tasks by SLA Domain.
ECS Field Reference
Please refer to the following document for detailed information on ECS fields.
Exported fields
Field | Description | Type | Metric Type |
---|---|---|---|
@timestamp |
Event timestamp. |
date |
|
data_stream.dataset |
Data stream dataset. |
constant_keyword |
|
data_stream.namespace |
Data stream namespace. |
constant_keyword |
|
data_stream.type |
Data stream type. |
constant_keyword |
|
rubrik.cluster.id |
The cluster UUID. |
keyword |
|
rubrik.cluster.name |
The cluster name. |
keyword |
|
rubrik.sla_domain.id |
The Rubrik SLA domain id. |
keyword |
|
rubrik.sla_domain.name |
The Rubrik SLA domain name. |
keyword |
|
rubrik.tasks.canceled.count |
The number of tasks that have been canceled. |
long |
gauge |
rubrik.tasks.failed.count |
The number of tasks that have failed. |
long |
gauge |
rubrik.tasks.metric_type |
The metric type. |
keyword |
|
rubrik.tasks.missed.count |
The number of tasks that have missed. |
long |
gauge |
rubrik.tasks.succeeded.count |
The number of tasks that have succeeded. |
long |
gauge |
Example
An example event for tasks
looks as following:
{ "agent": { "name": "docker-fleet-agent", "id": "6cc06f03-70ef-4dbc-aada-2891efc09a09", "ephemeral_id": "1b4ac717-821e-4363-b42e-5a13ba790f8c", "type": "filebeat", "version": "8.16.0" }, "rubrik": { "sla_domain": { "name": "name-1", "id": "4755b8b8-116b-4466-affb-c683f9339b10" }, "tasks": { "metric_type": "succeeded_tasks", "succeeded": { "count": 7 } } }, "@timestamp": "2025-01-17T21:58:09.564Z", "ecs": { "version": "8.16.0" }, "data_stream": { "namespace": "default", "type": "metrics", "dataset": "rubrik.tasks" }, "elastic_agent": { "id": "6cc06f03-70ef-4dbc-aada-2891efc09a09", "version": "8.16.0", "snapshot": false }, "host": { "hostname": "docker-fleet-agent", "os": { "kernel": "6.8.0-51-generic", "name": "Wolfi", "type": "linux", "version": "20230201", "platform": "wolfi" }, "containerized": false, "ip": [ "172.18.0.7" ], "name": "docker-fleet-agent", "mac": [ "02-42-AC-12-00-07" ], "architecture": "x86_64" }, "event": { "agent_id_status": "verified", "ingested": "2025-01-17T21:58:10Z", "kind": "metric", "dataset": "rubrik.tasks" } }
Global Cluster Performance
editThe global_cluster_performance
dataset provides performance related metrics like IOPS, throughput, storage utilization, storage details, streams, and physical ingest of Rubrik Clusters.
ECS Field Reference
Please refer to the following document for detailed information on ECS fields.
Exported fields
Field | Description | Type | Unit | Metric Type |
---|---|---|---|---|
@timestamp |
Event timestamp. |
date |
||
data_stream.dataset |
Data stream dataset. |
constant_keyword |
||
data_stream.namespace |
Data stream namespace. |
constant_keyword |
||
data_stream.type |
Data stream type. |
constant_keyword |
||
rubrik.cluster.id |
The cluster UUID. |
keyword |
||
rubrik.cluster.name |
The cluster name. |
keyword |
||
rubrik.cluster.type |
The type of the cluster (e.g., OnPrem, Robo, Polaris). |
keyword |
||
rubrik.cluster_performance.available_capacity.bytes |
The amount of available storage capacity in bytes. |
long |
byte |
gauge |
rubrik.cluster_performance.average_daily_growth.bytes |
The average daily growth of data in bytes. |
long |
byte |
gauge |
rubrik.cluster_performance.cdp_capacity.bytes |
The amount of storage used by Continuous Data Protection (CDP) in bytes. |
long |
byte |
gauge |
rubrik.cluster_performance.estimated_runway |
The estimated number of days before the cluster reaches full capacity. |
long |
||
rubrik.cluster_performance.ingested_snapshot_storage.bytes |
The total amount of ingested snapshot storage in bytes. |
long |
byte |
gauge |
rubrik.cluster_performance.live_mount_capacity.bytes |
The amount of storage used by live mounts in bytes. |
long |
byte |
gauge |
rubrik.cluster_performance.miscellaneous_capacity.bytes |
The amount of storage used for miscellaneous purposes in bytes. |
long |
byte |
gauge |
rubrik.cluster_performance.pending_snapshot_capacity.bytes |
The amount of storage reserved for pending snapshots in bytes. |
long |
byte |
gauge |
rubrik.cluster_performance.physical_snapshot_storage.bytes |
The amount of physical storage used by snapshots in bytes. |
long |
byte |
gauge |
rubrik.cluster_performance.snapshot_capacity.bytes |
The total storage capacity used by snapshots in bytes. |
long |
byte |
gauge |
rubrik.cluster_performance.status |
The current connectivity status of the cluster. |
keyword |
||
rubrik.cluster_performance.total_capacity.bytes |
The total storage capacity of the cluster in bytes. |
long |
byte |
gauge |
rubrik.cluster_performance.used_capacity.bytes |
The amount of used storage capacity in bytes. |
long |
byte |
gauge |
Example
An example event for global_cluster_performance
looks as following:
{ "agent": { "name": "ip-172-31-39-96", "id": "7c37e065-93e1-4e86-a2c9-ee166c4eccbb", "type": "filebeat", "ephemeral_id": "e897b559-c04a-471f-ba91-b2e6b84a5a3c", "version": "8.13.2" }, "rubrik": { "cluster": { "id": "b1a9e557-0b47-4bc1-841d-e6379e733016", "name": "prod-rub1", "type": "Robo" }, "cluster_performance": { "miscellaneous_capacity": { "bytes": 3490865159 }, "pending_snapshot_capacity": { "bytes": 2064 }, "physical_snapshot_storage": { "bytes": 313507076073 }, "live_mount_capacity": { "bytes": 0 }, "used_capacity": { "bytes": 316997943296 }, "ingested_snapshot_storage": { "bytes": 436860485632 }, "snapshot_capacity": { "bytes": 313507076073 }, "available_capacity": { "bytes": 719592345600 }, "total_capacity": { "bytes": 1036590288896 }, "average_daily_growth": { "bytes": 630829064 }, "cdp_capacity": { "bytes": 0 }, "estimated_runway": 1140, "status": "Disconnected" } }, "@timestamp": "2025-01-31T13:41:37.416Z", "ecs": { "version": "8.16.0" }, "data_stream": { "namespace": "default", "type": "metrics", "dataset": "rubrik.global_cluster_performance" }, "elastic_agent": { "id": "7c37e065-93e1-4e86-a2c9-ee166c4eccbb", "version": "8.13.2", "snapshot": false }, "host": { "hostname": "ip-172-31-39-96", "os": { "kernel": "6.1.82-99.168.amzn2023.x86_64", "codename": "Amazon Linux", "name": "Amazon Linux", "type": "linux", "family": "redhat", "version": "2023", "platform": "amzn" }, "containerized": false, "ip": [ "172.31.39.96", "fe80::88f:89ff:fea6:2561", "172.17.0.1", "fe80::42:77ff:fe00:bad7", "172.18.0.1", "fe80::42:ff:fe6c:4aef", "fe80::1803:deff:fef6:6cf3", "172.19.0.1", "fe80::42:dff:fed2:b9a9", "fe80::54a9:a8ff:feb8:2d8d" ], "name": "ip-172-31-39-96", "id": "ec2130e5d5c423ed85ac1c1a0b96beeb", "mac": [ "02-42-00-6C-4A-EF", "02-42-0D-D2-B9-A9", "02-42-77-00-BA-D7", "0A-8F-89-A6-25-61", "1A-03-DE-F6-6C-F3", "56-A9-A8-B8-2D-8D" ], "architecture": "x86_64" }, "event": { "agent_id_status": "verified", "ingested": "2025-01-31T13:41:47Z", "original": "{\"estimatedRunway\":1140,\"id\":\"b1a9e557-0b47-4bc1-841d-e6379e733016\",\"metric\":{\"availableCapacity\":719592345600,\"averageDailyGrowth\":630829064,\"cdpCapacity\":0,\"ingestedSnapshotStorage\":436860485632,\"liveMountCapacity\":0,\"miscellaneousCapacity\":3490865159,\"pendingSnapshotCapacity\":2064,\"physicalSnapshotStorage\":313507076073,\"snapshotCapacity\":313507076073,\"totalCapacity\":1036590288896,\"usedCapacity\":316997943296},\"name\":\"prod-rub1\",\"status\":\"Disconnected\",\"type\":\"Robo\"}", "kind": "metric", "dataset": "rubrik.global_cluster_performance" }, "tags": [ "preserve_original_event", "rubrik.cluster_performance" ] }
Node Statistics
editThe node_statistics
dataset provides metrics related to the performance of the Rubrik cluster nodes.
ECS Field Reference
Please refer to the following document for detailed information on ECS fields.
Exported fields
Field | Description | Type | Unit | Metric Type |
---|---|---|---|---|
@timestamp |
Event timestamp. |
date |
||
data_stream.dataset |
Data stream dataset. |
constant_keyword |
||
data_stream.namespace |
Data stream namespace. |
constant_keyword |
||
data_stream.type |
Data stream type. |
constant_keyword |
||
rubrik.cluster.id |
Rubrik cluster UUID. |
keyword |
||
rubrik.cluster.name |
The name of the Rubrik cluster. |
keyword |
||
rubrik.cluster.type |
The type of the cluster (e.g., OnPrem, Robo, Polaris). |
keyword |
||
rubrik.node_statistics.cpu_stat.pct |
CPU utilization of the node. |
integer |
percent |
gauge |
rubrik.node_statistics.iops.reads |
Input/output read operations per second. |
long |
gauge |
|
rubrik.node_statistics.iops.writes |
Input/output write operations per second. |
long |
gauge |
|
rubrik.node_statistics.network.received.bytes |
Data received over the network, in bytes per second |
long |
byte |
gauge |
rubrik.node_statistics.network.transmitted.bytes |
Data transmitted over the network, in bytes per second. |
long |
byte |
gauge |
rubrik.node_statistics.node_id |
Rubrik cluster node ID. |
keyword |
||
rubrik.node_statistics.throughput.read.bytes |
Read Input/output throughput, in bytes per second. |
long |
byte |
gauge |
rubrik.node_statistics.throughput.write.bytes |
Write Input/output throughput, in bytes per second. |
long |
byte |
gauge |
rubrik.node_statistics.time |
Time at which the performance metrics were retrieved. |
date |
||
rubrik.node_statistics.used_memory.pct |
Memory used on the node, in percentage. |
integer |
percent |
gauge |
Example
An example event for node_statistics
looks as following:
{ "agent": { "name": "docker-fleet-agent", "id": "ba00d2e5-7a61-421c-ac7e-71f3a26344a6", "ephemeral_id": "ab946963-2371-42e5-aed8-a25f4d04356a", "type": "filebeat", "version": "8.16.0" }, "rubrik": { "cluster": { "name": "cluster-1", "id": "c9382b9a-68ed-4464-94a9-aa51e9292a6a", "type": "Robo" }, "node_statistics": { "used_memory": { "pct": 82 }, "iops": { "reads": 9, "writes": 30 }, "throughput": { "read.bytes": 98374, "write.bytes": 505112 }, "time": "2025-01-04T00:11:00.000Z", "cpu_stat": { "pct": 30 }, "node_id": "VXVW241EE7D12", "network": { "transmitted.bytes": 1519, "received.bytes": 212 } } }, "@timestamp": "2025-01-04T00:11:00.000Z", "ecs": { "version": "8.16.0" }, "data_stream": { "namespace": "default", "type": "metrics", "dataset": "rubrik.node_statistics" }, "elastic_agent": { "id": "ba00d2e5-7a61-421c-ac7e-71f3a26344a6", "version": "8.16.0", "snapshot": false }, "host": { "hostname": "docker-fleet-agent", "os": { "kernel": "6.8.0-52-generic", "name": "Wolfi", "type": "linux", "version": "20230201", "platform": "wolfi" }, "containerized": false, "ip": [ "172.18.0.7" ], "name": "docker-fleet-agent", "mac": [ "02-42-AC-12-00-07" ], "architecture": "x86_64" }, "event": { "agent_id_status": "verified", "ingested": "2025-02-04T10:44:52Z", "kind": "metric", "dataset": "rubrik.node_statistics" }, "tags": [ "rubrik.node_statistics" ] }
Changelog
editChangelog
Version | Details | Kibana version(s) |
---|---|---|
0.4.0 |
Enhancement (View pull request) |
— |
0.3.0 |
Enhancement (View pull request) |
— |
0.2.0 |
Enhancement (View pull request) Enhancement (View pull request) Enhancement (View pull request) Enhancement (View pull request) Enhancement (View pull request) Enhancement (View pull request) Enhancement (View pull request) Enhancement (View pull request) Enhancement (View pull request) |
— |
0.1.0 |
Enhancement (View pull request) |
— |
On this page