- Machine Learning: other versions:
- Setup and security
- Getting started with machine learning
- Anomaly detection
- Overview
- Concepts
- Configure anomaly detection
- API quick reference
- Supplied configurations
- Function reference
- Examples
- Generating alerts for anomaly detection jobs
- Aggregating data for faster performance
- Customizing detectors with custom rules
- Detecting anomalous categories of data
- Detecting anomalous locations in geographic data
- Performing population analysis
- Altering data in your datafeed with runtime fields
- Adding custom URLs to machine learning results
- Handling delayed data
- Mapping anomalies by location
- Exporting and importing machine learning jobs
- Limitations
- Troubleshooting
- Data frame analytics
IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Metricbeat anomaly detection configurations
editMetricbeat anomaly detection configurations
editThese anomaly detection job wizards appear in Kibana if you use the Metricbeat system module to monitor your servers. For more details, see the datafeed and job definitions in GitHub.
These configurations are only available if data exists that matches the recognizer query specified in the manifest file.
- high_mean_cpu_iowait_ecs
-
-
For Metricbeat data where
event.dataset
issystem.cpu
andsystem.filesystem
. -
Models CPU time spent in iowait for every
host.name
. - Detects unusual increases in cpu time spent in iowait.
-
For Metricbeat data where
- max_disk_utilization_ecs
-
-
For Metricbeat data where
event.dataset
issystem.cpu
andsystem.filesystem
. -
Models disk utilization for each
host.name
. - Detects unusual increases in disk utilization.
-
For Metricbeat data where
- metricbeat_outages_ecs
-
-
For Metricbeat data where
event.dataset
issystem.cpu
andsystem.filesystem
. - Models counts of Metricbeat documents.
- Detects unusual decreases in Metricbeat documents.
-
For Metricbeat data where
Was this helpful?
Thank you for your feedback.