Search code examples
elasticsearchlogstashkibanametricbeat

How do I get metricbeat to report normalized CPU percentages to Kibana


I have the following metricbeat simple configuration:

#==========================  Modules configuration ============================
metricbeat.modules:

#------------------------------- System Module -------------------------------
- module: system
  metricsets: ["cpu"]
  period: 10s
  cpu.metrics:  ["percentages", "normalized_percentages"]

#----------------------------- Logstash output --------------------------------
output.logstash:
# The Logstash hosts
    hosts: ["<ip>:5000"]

With this information, when I get to Kibana (or Grafana) and try to analyze the data, I only see the normal CPU fields, not the normalized ones, e.g.,

(...) 
"system": {
      "cpu": {
        "softirq": {
          "pct": 0
        },
        "user": {
          "pct": 0.0243
        },
        "nice": {
          "pct": 0
        },
        "irq": {
          "pct": 0
        },
        "iowait": {
          "pct": 0.0101
        },
        "idle": {
          "pct": 1.9545
        },
        "steal": {
          "pct": 0
        },
        "system": {
          "pct": 0.0111
        },
        "cores": 2
      }
    },
(...)

I do not see the normalized % as an option in either the "Add a filter" section in Kibana, or in the Index Patterns section, so it must not be getting in other way.

I'm running metricbeat 5.6.12 against a 6.4.2 ELK single-node cluster (inside Docker).

My logstash configuration looks like this:

input {
        beats {
                port => 5000
        }
}

## Add your filters / logstash plugins configuration here

output {
        elasticsearch {
                hosts => "elasticsearch:9200"
                manage_template => false
                index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
                document_type => "%{[@metadata][type]}"
        }
}

I have already restarted metricbeat to load the configurations, and confirmed the problem is still happening.


Solution

  • metricbeat 5.6.12 against a 6.4.2 ELK

    When rereading this today something clicked! It was just a version mismatch. Upon ensuring I was running a 6.x version of metricbeat, the metrics are now propagating correctly.