Metricbeat anomaly detection configurations

edit

These anomaly detection job wizards appear in Kibana if you use the Metricbeat system module to monitor your servers. For more details, see the datafeed and job definitions in GitHub.

These configurations are only available if data exists that matches the recognizer query specified in the manifest file.

high_mean_cpu_iowait_ecs
  • For Metricbeat data where event.dataset is system.cpu and system.filesystem.
  • Models CPU time spent in iowait for every host.name.
  • Detects unusual increases in cpu time spent in iowait.
max_disk_utilization_ecs
  • For Metricbeat data where event.dataset is system.cpu and system.filesystem.
  • Models disk utilization for each host.name.
  • Detects unusual increases in disk utilization.
metricbeat_outages_ecs
  • For Metricbeat data where event.dataset is system.cpu and system.filesystem.
  • Models counts of Metricbeat documents.
  • Detects unusual decreases in Metricbeat documents.