ELK之 MetricBeat监控Kibana的Dashboard各个图表对应生成方式

如有问题欢迎指出 ，谢谢~

一、添加自定义字段

fields:
  type: system
  vmId: test123
  userId: test123
  customerId: test123
fields_under_root: true

效果如下

二、监控数据面板展示

所有查询均为时间区间查询

图表面板查询首先添加filter过滤查询

GET metric*/_search?size=100
{
   
 "query":{
   
   "bool": {
   "filter": {
   
     "bool": {
   
       "must":{
   
         "query_string": {
   
           "fields":["beat.name"],
           "query": "k8s-fengfan"
         }
       }
     }
   }}
 }

1、cpu

字段	对应图表
如果system.cpu.cores>0则 (system.cpu.user.pct+system.cpu.system.pct)/system.cpu.cores
按照system.cpu.user.pct排名 beat.name：system.cpu.user.pct
User：system.cpu.user.pct system：system.cpu.system.pct nice：system.cpu.nice.pct irq：system.cpu.irq.pct softirq：system.cpu.softirq.pct iowait：system.cpu.iowait.pct
附录1	Hosts histogram by CPU usage

2、load

字段	对应图表
system.load.5
1m：system.load.1 5m：system.load.5 15m：system.load.15

3、memory

字段	对应图表
system.memory.actual.used.bytes system.memory.total
system.memory.actual.used.pct 按照system.memory.actual.used.pct排名 beat.name：system.memory.actual.used.pct
system.memory.swap.used.pct
Used=system.memory.actual.used.bytes Free=system.momery.free Cache=如果system.memory.actual.used.bytes和system.memory.used.bytes不为空则等于system.memory.actual.used.bytes-system.memory.used.bytes否则为null

4、process

会生成多条文档（与当前进程数相同，每个进程一条记录）

字段	对应图表
附录2
按照system.process.memory.rss.pct的平均值排名取前10，显示system.process.name：system.process.memory.rss.pct 根据配置文件process.include_top_n.by_memory=10来获取10条记录
按照system.process.cpu.total.pct的平均值排名取前10，显示system.process.name：system.process.cpu.total.pct 根据配置文件process.include_top_n.by_cpu=10来获取10条记录

5、fileSystem

会生成多条文档（每个文件系统一个文档数据)

processors.drop_event.when.regexp.system.filesystem.mount_point=’^/(sys|cgroup|proc|dev|etc|host|lib)($|/)’

过滤了部分数据

字段	对应图表
-system.filesystem.mount_point:/run* AND -system.filesystem.mount_point:/sys* AND -system.filesystem.mount_point:/dev* AND -system.filesystem.mount_point:/proc* AND -system.filesystem.mount_point:/var* AND -system.filesystem.mount_point:/boot的平均值system.filesystem.used.pct

6、fsstat

会生成多条文档，求平均数

字段	对应图表
system.fsstat.total_size.used不为空且system.fsstat.total_size.tota不为空，则等于system.fsstat.total_size.used/system.fsstat.total_size.tota，否则为null

附：部分图表查询方式

附录1

请求体

{
   
  "size": 0,
  "_source": {
   
    "excludes": []
  },
  "aggs": {
   
    "2": {
   
      "date_histogram": {
   
        "field": "@timestamp",
        "interval": "30s",
        "time_zone": "Asia/Shanghai",
        "min_doc_count": 1
      },
      "aggs": {
   
        "3": {
   
          "terms": {
   
            "field": "beat.name",
            "size": 20,
            "order": {
   
              "1": "desc"
            }
          },
          "aggs": {
   
            "1": {
   
              "avg": {
   
                "field": "system.cpu.user.pct"
              }
            }
          }
        }
      }
    }
  },
  "version": true,
  "stored_fields": [
    "*"
  ],
  "script_fields": {
   },
  "docvalue_fields": [
    "@timestamp",
    "ceph.monitor_health.last_updated",
    "docker.container.created",
    "docker.healthcheck.event.end_date",
    "docker.healthcheck.event.start_date",
    "docker.image.created",
    "kubernetes.container.start_time",
    "kubernetes.event.metadata.timestamp.created",
    "kubernetes.node.start_time",
    "kubernetes.pod.start_time",
    "kubernetes.system.start_time",
    "mongodb.status.background_flushing.last_finished",
    "mongodb.status.local_time",
    "php_fpm.pool.start_time",
    "postgresql.activity.backend_start",
    "postgresql.activity.query_start",
    "postgresql.activity.state_change",
    "postgresql.activity.transaction_start",
    "postgresql.bgwriter.stats_reset",
    "postgresql.database.stats_reset",
    "system.process.cpu.start_time"
  ],
  "query": {
   
    "bool": {
   
      "must": [
        {
   
          "query_string": {
   
            "query": "*",
            "analyze_wildcard": true,
            "default_field": "*"
          }
        },
        {
   
          "query_string": {
   
            "analyze_wildcard": true,
            "default_field": "*",
            "query": "*"
          }
        },
        {
   
          "range": {
   
            "