Elastalert rule for CPU usage in percentage












0















I am facing issue with elastalert rule for CPU usage (not load average). I am not getting any hit and match. Below is my .yaml file for CPU rule:



name: CPU usgae
type: metric_aggregation
index: metricbeat-*
buffer_time:
minutes: 10
metric_agg_key: system.cpu.total.pct
metric_agg_type: avg
query_key: beat.hostname
doc_type: doc
bucket_interval:
minutes: 5
sync_bucket_interval: true
max_threshold: 60.0
filter:
- term:
metricset.name: cpu
alert:
- "email"
email:
- "xyz@xy.com"


Can you please help me what changes i need to make in my rule.



Any assistance will be appreciated.



Thanks.










share|improve this question



























    0















    I am facing issue with elastalert rule for CPU usage (not load average). I am not getting any hit and match. Below is my .yaml file for CPU rule:



    name: CPU usgae
    type: metric_aggregation
    index: metricbeat-*
    buffer_time:
    minutes: 10
    metric_agg_key: system.cpu.total.pct
    metric_agg_type: avg
    query_key: beat.hostname
    doc_type: doc
    bucket_interval:
    minutes: 5
    sync_bucket_interval: true
    max_threshold: 60.0
    filter:
    - term:
    metricset.name: cpu
    alert:
    - "email"
    email:
    - "xyz@xy.com"


    Can you please help me what changes i need to make in my rule.



    Any assistance will be appreciated.



    Thanks.










    share|improve this question

























      0












      0








      0








      I am facing issue with elastalert rule for CPU usage (not load average). I am not getting any hit and match. Below is my .yaml file for CPU rule:



      name: CPU usgae
      type: metric_aggregation
      index: metricbeat-*
      buffer_time:
      minutes: 10
      metric_agg_key: system.cpu.total.pct
      metric_agg_type: avg
      query_key: beat.hostname
      doc_type: doc
      bucket_interval:
      minutes: 5
      sync_bucket_interval: true
      max_threshold: 60.0
      filter:
      - term:
      metricset.name: cpu
      alert:
      - "email"
      email:
      - "xyz@xy.com"


      Can you please help me what changes i need to make in my rule.



      Any assistance will be appreciated.



      Thanks.










      share|improve this question














      I am facing issue with elastalert rule for CPU usage (not load average). I am not getting any hit and match. Below is my .yaml file for CPU rule:



      name: CPU usgae
      type: metric_aggregation
      index: metricbeat-*
      buffer_time:
      minutes: 10
      metric_agg_key: system.cpu.total.pct
      metric_agg_type: avg
      query_key: beat.hostname
      doc_type: doc
      bucket_interval:
      minutes: 5
      sync_bucket_interval: true
      max_threshold: 60.0
      filter:
      - term:
      metricset.name: cpu
      alert:
      - "email"
      email:
      - "xyz@xy.com"


      Can you please help me what changes i need to make in my rule.



      Any assistance will be appreciated.



      Thanks.







      elastalert






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked Oct 16 '18 at 10:15









      Tekchand DagarTekchand Dagar

      85




      85
























          2 Answers
          2






          active

          oldest

          votes


















          1














          Metricbeat reports CPU values in the range of 0 to 1. So a threshold of 60 will never be matched.



          Try it with max_threshold: 0.6 and it probably will work.






          share|improve this answer
























          • I have made the changes as suggested by you. But still i am not getting any hit and alerts. My CPU usage is 100% so it should get hit. I have checked on Kibana dashboard system.cpu.total.pct also showing 100%.

            – Tekchand Dagar
            Oct 17 '18 at 7:52











          • what does the original json look like?

            – Faulander
            Oct 17 '18 at 15:30



















          0














          Try reducing buffer_time and bucket_interval for testing






          share|improve this answer
























            Your Answer






            StackExchange.ifUsing("editor", function () {
            StackExchange.using("externalEditor", function () {
            StackExchange.using("snippets", function () {
            StackExchange.snippets.init();
            });
            });
            }, "code-snippets");

            StackExchange.ready(function() {
            var channelOptions = {
            tags: "".split(" "),
            id: "1"
            };
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function() {
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled) {
            StackExchange.using("snippets", function() {
            createEditor();
            });
            }
            else {
            createEditor();
            }
            });

            function createEditor() {
            StackExchange.prepareEditor({
            heartbeatType: 'answer',
            autoActivateHeartbeat: false,
            convertImagesToLinks: true,
            noModals: true,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: 10,
            bindNavPrevention: true,
            postfix: "",
            imageUploader: {
            brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
            contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
            allowUrls: true
            },
            onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            });


            }
            });














            draft saved

            draft discarded


















            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f52833182%2felastalert-rule-for-cpu-usage-in-percentage%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown

























            2 Answers
            2






            active

            oldest

            votes








            2 Answers
            2






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes









            1














            Metricbeat reports CPU values in the range of 0 to 1. So a threshold of 60 will never be matched.



            Try it with max_threshold: 0.6 and it probably will work.






            share|improve this answer
























            • I have made the changes as suggested by you. But still i am not getting any hit and alerts. My CPU usage is 100% so it should get hit. I have checked on Kibana dashboard system.cpu.total.pct also showing 100%.

              – Tekchand Dagar
              Oct 17 '18 at 7:52











            • what does the original json look like?

              – Faulander
              Oct 17 '18 at 15:30
















            1














            Metricbeat reports CPU values in the range of 0 to 1. So a threshold of 60 will never be matched.



            Try it with max_threshold: 0.6 and it probably will work.






            share|improve this answer
























            • I have made the changes as suggested by you. But still i am not getting any hit and alerts. My CPU usage is 100% so it should get hit. I have checked on Kibana dashboard system.cpu.total.pct also showing 100%.

              – Tekchand Dagar
              Oct 17 '18 at 7:52











            • what does the original json look like?

              – Faulander
              Oct 17 '18 at 15:30














            1












            1








            1







            Metricbeat reports CPU values in the range of 0 to 1. So a threshold of 60 will never be matched.



            Try it with max_threshold: 0.6 and it probably will work.






            share|improve this answer













            Metricbeat reports CPU values in the range of 0 to 1. So a threshold of 60 will never be matched.



            Try it with max_threshold: 0.6 and it probably will work.







            share|improve this answer












            share|improve this answer



            share|improve this answer










            answered Oct 16 '18 at 11:45









            FaulanderFaulander

            936




            936













            • I have made the changes as suggested by you. But still i am not getting any hit and alerts. My CPU usage is 100% so it should get hit. I have checked on Kibana dashboard system.cpu.total.pct also showing 100%.

              – Tekchand Dagar
              Oct 17 '18 at 7:52











            • what does the original json look like?

              – Faulander
              Oct 17 '18 at 15:30



















            • I have made the changes as suggested by you. But still i am not getting any hit and alerts. My CPU usage is 100% so it should get hit. I have checked on Kibana dashboard system.cpu.total.pct also showing 100%.

              – Tekchand Dagar
              Oct 17 '18 at 7:52











            • what does the original json look like?

              – Faulander
              Oct 17 '18 at 15:30

















            I have made the changes as suggested by you. But still i am not getting any hit and alerts. My CPU usage is 100% so it should get hit. I have checked on Kibana dashboard system.cpu.total.pct also showing 100%.

            – Tekchand Dagar
            Oct 17 '18 at 7:52





            I have made the changes as suggested by you. But still i am not getting any hit and alerts. My CPU usage is 100% so it should get hit. I have checked on Kibana dashboard system.cpu.total.pct also showing 100%.

            – Tekchand Dagar
            Oct 17 '18 at 7:52













            what does the original json look like?

            – Faulander
            Oct 17 '18 at 15:30





            what does the original json look like?

            – Faulander
            Oct 17 '18 at 15:30













            0














            Try reducing buffer_time and bucket_interval for testing






            share|improve this answer




























              0














              Try reducing buffer_time and bucket_interval for testing






              share|improve this answer


























                0












                0








                0







                Try reducing buffer_time and bucket_interval for testing






                share|improve this answer













                Try reducing buffer_time and bucket_interval for testing







                share|improve this answer












                share|improve this answer



                share|improve this answer










                answered Dec 19 '18 at 6:30









                Debashish SenDebashish Sen

                11316




                11316






























                    draft saved

                    draft discarded




















































                    Thanks for contributing an answer to Stack Overflow!


                    • Please be sure to answer the question. Provide details and share your research!

                    But avoid



                    • Asking for help, clarification, or responding to other answers.

                    • Making statements based on opinion; back them up with references or personal experience.


                    To learn more, see our tips on writing great answers.




                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function () {
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f52833182%2felastalert-rule-for-cpu-usage-in-percentage%23new-answer', 'question_page');
                    }
                    );

                    Post as a guest















                    Required, but never shown





















































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown

































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown







                    Popular posts from this blog

                    How to change which sound is reproduced for terminal bell?

                    Can I use Tabulator js library in my java Spring + Thymeleaf project?

                    Title Spacing in Bjornstrup Chapter, Removing Chapter Number From Contents