IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Metricbeat

edit

These anomaly detection job wizards appear in Kibana if you use the Metricbeat system module to monitor your servers.

high_mean_cpu_iowait_ecs
  • For Metricbeat data where event.dataset is system.cpu and system.filesystem.
  • Models CPU time spent in iowait (partition_field_name is host.name).
  • Detects unusual increases in cpu time spent in iowait (using the high_mean function).
max_disk_utilization_ecs
  • For Metricbeat data where event.dataset is system.cpu and system.filesystem.
  • Models disc utilization (partition_field_name is host.name).
  • Detects unusual increases in disk utilization (using the max function).
metricbeat_outages_ecs
  • For Metricbeat data where event.dataset is system.cpu and system.filesystem.
  • Models counts of Metricbeat documents (partition_field_name is event.dataset).
  • Detects unusual decreases in Metricbeat documents (using the low_count function).