Metricbeatedit

These anomaly detection job wizards appear in Kibana if you use the Metricbeat system module to monitor your servers.

high_mean_cpu_iowait_ecs
  • For Metricbeat data where event.dataset is system.cpu and system.filesystem.
  • Models CPU time spent in iowait (partition_field_name is host.name).
  • Detects unusual increases in cpu time spent in iowait (using the high_mean function).
max_disk_utilization_ecs
  • For Metricbeat data where event.dataset is system.cpu and system.filesystem.
  • Models disc utilization (partition_field_name is host.name).
  • Detects unusual increases in disk utilization (using the max function).
metricbeat_outages_ecs
  • For Metricbeat data where event.dataset is system.cpu and system.filesystem.
  • Models counts of Metricbeat documents (partition_field_name is event.dataset).
  • Detects unusual decreases in Metricbeat documents (using the low_count function).