Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Metricbeat][System] Use aggregated fields in the visualizations for Diskio and Network #35765

Open
herrBez opened this issue Jun 14, 2023 · 2 comments
Labels
needs_team Indicates that the issue/PR needs a Team:* label Stalled

Comments

@herrBez
Copy link
Contributor

herrBez commented Jun 14, 2023

Describe the enhancement:

As of now the visualizations:

  • Disk IO (Bytes) [Metricbeat System] ECS
  • Network Traffic (Bytes) [Metricbeat System] ECS
  • Network Traffic (Packets) [Metricbeat System] ECS

use per-disk/per-network-interface metrics instead of aggregated host metrics (that are already computed by the module), meaning that in the Dashboard [Metricbeat System] Host overview ECS we are not getting a whole host view, but rather the disk/network interface with the most reads/writes. Further, since we are computing the derivative of a max, we can potentially compare different disks/network interfaces in different intervals potentially yielding to misleading results.

The suggestion of this issue is to use the aggregated fields in the dashboards. In the following table I list the current fields in use and the proposed fields:

Visualizations Current Fields Proposed fields
Disk IO (Bytes) [Metricbeat System] ECS system.diskio.read.bytes system.diskio.write.bytes host.disk.read.bytes host.disk.write.bytes
Network Traffic (Bytes) [Metricbeat System] ECS system.network.in.bytes system.network.out.bytes host.network.ingress.bytes host.network.egress.bytes
Network Traffic (Packets) [Metricbeat System] ECS system.network.in.packets system.network.out.packets host.network.ingress.packets host.network.egress.packets

Describe a specific use case for the enhancement or feature:

The use-case for this enhancement is to have a "whole" host view instead of the disk/network-interface with the most read/writes.

Related Issue
elastic/integrations#6565

@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Jun 14, 2023
@botelastic
Copy link

botelastic bot commented Jun 14, 2023

This issue doesn't have a Team:<team> label.

@botelastic
Copy link

botelastic bot commented Jun 13, 2024

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!

@botelastic botelastic bot added the Stalled label Jun 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs_team Indicates that the issue/PR needs a Team:* label Stalled
Projects
None yet
Development

No branches or pull requests

1 participant