Beats: Metricbeat dashboard top CPU does not account for cores

[mbrancato]

In the Metricbeat dashboards, the CPU usage is for a single core. This leads to CPU usages > 100% in the top hosts by CPU visualization.

I fixed this by adding a Math section and dividing by the system.cpu.cores value.

• Version: 6.3.2

[ruflin]

There is also an entry system.cpu.total.norm.pct which contains the normalised percentage value and already did the calculation for you.

It's an ongoing discussion which one should be shown by default. Could you share some background why you prefer one over the other?

[mbrancato]

@ruflin I tried the system.cpu.total.norm.pct and all the graph showed was 0%, but the bar graph were not ordered and were different lengths.

I'm leaving our math section in place. To answer your question, showing overall CPU is a better display for this graph which attempts to show hosts using the most CPU. I think it better serves the dashboard to show the overall CPU usage, not just the first core. If you want to not average, what I would do is find a different way to visualize all the cores, not a bar graph. Something that shows max, min, and mean/median core usage... I sound like I'm describing a box plot, but I don't mean to suggest that.

[willemdh]

@ruflin system.cpu.total.norm.pct is definitely a better default choice... With a wide range of servers ranging from 1 to 32 cpu's, it's defintely more useful then having cpu values going 800+ % while others are below 50. This gives very weird results, which are very hard to understand for some users.

[mbrancato]

@willemdh except with 6.3.2 it seems system.cpu.total.norm.pct is always showing 0%. But yes, showing overall CPU is much more useful than summing all the CPU core percentages.

[DPattee]

Agreed on showing normalized by default.

When I'm viewing information directly on a single system I want the real 'non-normalized' information since it is a higher resolution / more meaningful data point. But when I am comparing multiple servers of a single service type that may have different physical core or vcpu assignments (i.e. a set of web servers on physical hardware of slightly different generations so maybe 8 and 12 cores) I want to be able to quickly see which machines are overtaxed and need upgrading.

Looks like the default changes I'd want to see would be:
in system.yml= cpu.metrics: [percentages, normalized_percentages]
in top hosts by cpu (realtime) [metricbeat system] = switch to system.cpu.user.norm.pct
in hosts histogram by cpu usage [metricbeat system] = switch to system.cpu.user.norm.pct

[kaiyan-sheng]

Great suggestions, thank you! I will keep this issue open for these potential changes.

Looks like the default changes I'd want to see would be:
in system.yml= cpu.metrics: [percentages, normalized_percentages]
in top hosts by cpu (realtime) [metricbeat system] = switch to system.cpu.user.norm.pct
in hosts histogram by cpu usage [metricbeat system] = switch to system.cpu.user.norm.pct

[botelastic[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[FreerideTheWorld]

After seeing the "Top Hosts by CPU" visualization hit over 1100% during testing yesterday I'd like to see this visualization fixed as well. I had to go into the server and look at how many cores it had, 32, and start doing some mental math. I don't really see how showing a customer 1100% makes this visualization useful and only puts more work on my plate.