- Stage: 3 (finished)
- Date: 2021-03-25
We are proposing to add 7 new host fields into ECS for monitoring CPU, disk and network performance using Metricbeat.
With existing host.id and host.name, these total 9 fields will become the common field schema for host metrics.
Proposed 7 new fields are:
- host.cpu.usage
- host.network.ingress.bytes
- host.network.ingress.packets
- host.network.egress.bytes
- host.network.egress.packets
- host.disk.read.bytes
- host.disk.write.bytes
This RFC calls for the addition of host fields to collect basic monitoring metrics from a host or VM such as CPU, network and disk.
Please see host.yml for definitions of all fields.
Note: the host.network.* and host.disk.* fields are gauges which represent
IO since the last metric collection. In order to interpret these metrics, the
collection period is needed. Collection period will be added into ECS separately.
These host metrics will be collected from different kinds of hosts such as bare metal, virtual machines or virtual machines on public clouds like AWS, Azure and GCP. These host metrics will be the standard minimal used in resource centric UI views. For example, when user has VMs on bare metal, AWS and Azure, these host fields will be collected from all VMs across all platforms and displayed in a centralized location for better monitoring experience.
- Bare metal
- VMs
- AWS EC2 instances
- GCP compute engines
- Azure compute VMs
Please see example source document from AWS EC2 instance in aws-ec2.json and example source document from Azure compute VM in azure-compute-vm.json.
For system metrics, CPU, network, diskIO are reported separately from different metricsets. Please see example source document for CPU in system-cpu.json and network in system-network.json.
No breaking changes required. These are new fields already added into Metricbeat:
- aws ec2 metricset
- googlecloud compute metricset
- azure compute_vm metricset
Only change would be once these fields are in ECS, we can remove these fields
from metricbeat/_meta/fields.common.yml file.
We need to carefully define each field because when these metrics are collected
from different platforms/services, the scope of these metrics change. We need to
make sure when users are using these metrics, they are all collected to represent
the same thing. For example, host.network.in.bytes needs to be an aggregated
value for all network interfaces. host.cpu.pct needs to be a normalized value
between 0 and 1.
Our goal is to switch related fields to these new host metrics in Kibana Observability
metrics UI. For example: right now under hosts inventory, CPU usage will only display
metrics that are collected by Metricbeat system module. With using the new host
metric fields, CPU metric from system module will be host.cpu.usage, as well
as CPU metrics from all AWS EC2 instances or Azure compute VMs. With
Kibana Metrics UI switching to
these new proposed host metric fields, all hosts will be discovered and displayed
in a single waffle map from different data collection sources.
The following are the people that consulted on the contents of this RFC.
- @kaiyan-sheng | author
- @cyrille-leclerc | sponsor
- @exekias | subject matter expert