- Observability: other versions:
- What is Elastic Observability?
- What’s new in 8.13
- Get started
- Observability AI Assistant
- Application performance monitoring (APM)
- Self manage APM Server
- Data Model
- Features
- How-to guides
- OpenTelemetry integration
- Manage storage
- Configure
- Advanced setup
- Secure communication
- Monitor
- API
- Troubleshoot
- Upgrade
- Release notes
- Known issues
- Log monitoring
- Infrastructure monitoring
- AWS monitoring
- Azure monitoring
- Synthetic monitoring
- Get started
- Scripting browser monitors
- Configure lightweight monitors
- Manage monitors
- Work with params and secrets
- Analyze monitor data
- Monitor resources on private networks
- Use the CLI
- Configure projects
- Configure Synthetics settings
- Grant users access to secured resources
- Manage data retention
- Use Synthetics with traffic filters
- Migrate from the Elastic Synthetics integration
- Scale and architect a deployment
- Synthetics support matrix
- Synthetics Encryption and Security
- Troubleshooting
- Uptime monitoring
- Real user monitoring
- Universal Profiling
- Alerting
- Service-level objectives (SLOs)
- Cases
- CI/CD observability
- Troubleshooting
- Fields reference
- Tutorials
Rate aggregation
editRate aggregation
editYou can use a rate aggregation to analyze the rate at which a specific field changes over time. This type of aggregation is useful when you want to analyze fields like counters.
For example, imagine you have a counter field called restarts that increments each time a service restarts. You can use rate aggregation to get an alert if the service restarts more than X times within a specific time window (for example, per day).
How rates are calculated
editRates used in alerting rules are calculated by comparing the maximum value of the field in the previous bucket to the maximum value of the field in the current bucket and then dividing the result by the number of seconds in the selected interval. For example, if the value of the restarts increases, the rate would be calculated as:
(max_value_in_current_bucket - max_value_in_previous_bucket)/interval_in_seconds
In this example, let’s assume you have one document per bucket with the following data:
{ "timestamp": 0000, "restarts": 0 } { "timestamp": 60000, "restarts": 1 }
Let’s assume the timestamp is a UNIX timestamp in milliseconds, and we started counting on Thursday, January 1, 1970 12:00:00 AM. In that case, the rate will be calculated as follows:
(max_value_in_current_bucket - max_value_in_previous_bucket)/interval_in_seconds
, where:
-
max_value_in_current_bucket
[now-1m → now]: 1 -
max_value_in_previous_bucket
[now-2m → now-1m]: 0 -
interval_in_seconds
: 60
The rate calculation would be: (1 - 0) / 60 = 0.0166666666667
If you want to alert when the rate of restarts is above 1 within a 1-minute window, you would set the threshold above 0.0166666666667
.
The calculation you need to use depends on the interval that’s selected.
On this page