datafeed_high_mean_cpu_iowait_ecs.json

{
  "job_id": "JOB_ID",
  "indices": [
    "INDEX_PATTERN_NAME"
  ],
  "query": {
    "bool": {
      "filter": {
        "term": {
          "event.dataset": "system.cpu"
        }
      },
      "must": {
        "exists": {
          "field": "system.cpu.iowait.pct"
        }
      }
    }
  }
}