Group and analyze metrics

The Metrics Explorer page enables you to create time-series visualizations based on aggregation of your metrics, chart them against related metrics, and break them down per the field of your choice. You can group and create visualizations of metrics for one or more resources that you are monitoring.

Additionally, for detailed analyses of your metrics, you can annotate and save visualizations for your custom dashboards by using the Time Series Visual Builder (TSVB) within Kibana.

To access this page, go to Observability > Metrics, and then click Metrics Explorer.

By default, the Metrics Explorer page displays the CPU usage for hosts, Kubernetes pods, and Docker containers. The initial configuration has the Average aggregation selected, the of field is populated with the default metrics, and the graph per dropdown is set to Everything.

As an example, let’s view the system load metrics for hosts we’re currently monitoring with Metricbeat.

In the of field, delete the selected metrics, and then add system.load.1, system.load.5, and system.load.15.

The graph displays the average values of the metrics you selected.
In the graph per dropdown, add host.name.

There is now an individual graph displaying the average values of the metrics for each host.
Select Actions in the top right-hand corner of one of the graphs and then click Add filter.

This graph now displays the metrics only for that host. The filter has added a Kibana Query Language filter for host.name in the second row of the Metrics Explorer configuration.
Let’s analyze some host-specific metrics. In the of field, delete each one of the system load metrics.
To explore the outbound network traffic, enter the system.network.out.bytes metric. This is a monotonically increasing value, so from the aggregation dropdown, select Rate.
Hosts have multiple network interfaces, so it is more meaningful to display one graph for each network interface. From the graph per dropdown, add the system.network.name field.

There is now a separate graph for each network interface.
Let’s visualize one of the graphs in TSVB. Choose a graph, click Actions, and then select Open In Visualize.

In this visualization the max of system.network.out.bytes is displayed, filtered by host.name and system.network.name.

The derivative aggregation is used to calculate the difference between each bucket. By default, the value of units is automatically set to 1s, along with the positive only aggregation.
To calculate the network traffic for all the interfaces, from the group by dropdown, select Terms and add the system.network.name field.
You will also need to add the Series Agg aggregation and the Sum function. From the Aggregation dropdown, select Series Agg, and from the Function dropdown, select Sum.
If you would like to save this visualization and add it to a custom dashboard later, click Save.

« AWS metrics Inspect metric anomalies »