Metricbeat

edit

These anomaly detection job wizards appear in Kibana if you use the Metricbeat system module to monitor your servers. For more details, see the datafeed and job definitions in GitHub.

high_mean_cpu_iowait_ecs
  • For Metricbeat data where event.dataset is system.cpu and system.filesystem.
  • Models CPU time spent in iowait (partition_field_name is host.name).
  • Detects unusual increases in cpu time spent in iowait (using the high_mean function).
max_disk_utilization_ecs
  • For Metricbeat data where event.dataset is system.cpu and system.filesystem.
  • Models disc utilization (partition_field_name is host.name).
  • Detects unusual increases in disk utilization (using the max function).
metricbeat_outages_ecs
  • For Metricbeat data where event.dataset is system.cpu and system.filesystem.
  • Models counts of Metricbeat documents (partition_field_name is event.dataset).
  • Detects unusual decreases in Metricbeat documents (using the low_count function).