From d2e400b43d11d0c117de5beee88cf4e96919a393 Mon Sep 17 00:00:00 2001 From: Nicholas Berlin Date: Fri, 3 Oct 2025 07:34:34 -0400 Subject: [PATCH 1/2] Add diag_documents_volume --- .../doc/endpoint/metrics/metrics.md | 17 ++ .../endpoint/data_stream/metrics/metrics.yaml | 17 ++ custom_schemas/custom_endpoint.yml | 95 ++++++++++ .../data_stream/metrics/fields/fields.yml | 96 ++++++++++ package/endpoint/docs/README.md | 19 ++ schemas/v1/metrics/metrics.yaml | 172 ++++++++++++++++++ 6 files changed, 416 insertions(+) diff --git a/custom_documentation/doc/endpoint/metrics/metrics.md b/custom_documentation/doc/endpoint/metrics/metrics.md index e06b83e46..96c085669 100644 --- a/custom_documentation/doc/endpoint/metrics/metrics.md +++ b/custom_documentation/doc/endpoint/metrics/metrics.md @@ -26,6 +26,23 @@ This is an internal state management document that includes metrics on Endpoint' | Endpoint.metrics.cpu.endpoint.histogram.values | | Endpoint.metrics.cpu.endpoint.latest | | Endpoint.metrics.cpu.endpoint.mean | +| Endpoint.metrics.diag_documents_volume.dns_events.sent_bytes | +| Endpoint.metrics.diag_documents_volume.dns_events.sent_count | +| Endpoint.metrics.diag_documents_volume.dns_events.suppressed_bytes | +| Endpoint.metrics.diag_documents_volume.dns_events.suppressed_count | +| Endpoint.metrics.diag_documents_volume.overall.sent_bytes | +| Endpoint.metrics.diag_documents_volume.overall.sent_count | +| Endpoint.metrics.diag_documents_volume.overall.suppressed_bytes | +| Endpoint.metrics.diag_documents_volume.overall.suppressed_count | +| Endpoint.metrics.diag_documents_volume.process_events.sent_bytes | +| Endpoint.metrics.diag_documents_volume.process_events.sent_count | +| Endpoint.metrics.diag_documents_volume.process_events.sources.sent_bytes | +| Endpoint.metrics.diag_documents_volume.process_events.sources.sent_count | +| Endpoint.metrics.diag_documents_volume.process_events.sources.source | +| Endpoint.metrics.diag_documents_volume.process_events.sources.suppressed_bytes | +| Endpoint.metrics.diag_documents_volume.process_events.sources.suppressed_count | +| Endpoint.metrics.diag_documents_volume.process_events.suppressed_bytes | +| Endpoint.metrics.diag_documents_volume.process_events.suppressed_count | | Endpoint.metrics.disks.device | | Endpoint.metrics.disks.endpoint_drive | | Endpoint.metrics.disks.free | diff --git a/custom_documentation/src/endpoint/data_stream/metrics/metrics.yaml b/custom_documentation/src/endpoint/data_stream/metrics/metrics.yaml index 05e804666..3570fb531 100644 --- a/custom_documentation/src/endpoint/data_stream/metrics/metrics.yaml +++ b/custom_documentation/src/endpoint/data_stream/metrics/metrics.yaml @@ -33,6 +33,23 @@ fields: - Endpoint.metrics.cpu.endpoint.histogram.values - Endpoint.metrics.cpu.endpoint.latest - Endpoint.metrics.cpu.endpoint.mean + - Endpoint.metrics.diag_documents_volume.dns_events.sent_bytes + - Endpoint.metrics.diag_documents_volume.dns_events.sent_count + - Endpoint.metrics.diag_documents_volume.dns_events.suppressed_bytes + - Endpoint.metrics.diag_documents_volume.dns_events.suppressed_count + - Endpoint.metrics.diag_documents_volume.overall.sent_bytes + - Endpoint.metrics.diag_documents_volume.overall.sent_count + - Endpoint.metrics.diag_documents_volume.overall.suppressed_bytes + - Endpoint.metrics.diag_documents_volume.overall.suppressed_count + - Endpoint.metrics.diag_documents_volume.process_events.sent_bytes + - Endpoint.metrics.diag_documents_volume.process_events.sent_count + - Endpoint.metrics.diag_documents_volume.process_events.sources.sent_bytes + - Endpoint.metrics.diag_documents_volume.process_events.sources.sent_count + - Endpoint.metrics.diag_documents_volume.process_events.sources.source + - Endpoint.metrics.diag_documents_volume.process_events.sources.suppressed_bytes + - Endpoint.metrics.diag_documents_volume.process_events.sources.suppressed_count + - Endpoint.metrics.diag_documents_volume.process_events.suppressed_bytes + - Endpoint.metrics.diag_documents_volume.process_events.suppressed_count - Endpoint.metrics.disks.device - Endpoint.metrics.disks.endpoint_drive - Endpoint.metrics.disks.free diff --git a/custom_schemas/custom_endpoint.yml b/custom_schemas/custom_endpoint.yml index f6ddb2d34..71bd5410b 100644 --- a/custom_schemas/custom_endpoint.yml +++ b/custom_schemas/custom_endpoint.yml @@ -460,6 +460,101 @@ type: object description: Metrics fields hold the endpoint and system's performance metrics + - name: metrics.diag_documents_volume + level: custom + type: object + description: Statistics about diagnostic documents + + - name: metrics.diag_documents_volume.dns_events.sent_bytes + level: custom + description: Total size of documents that would be sent + type: long + + - name: metrics.diag_documents_volume.dns_events.sent_count + level: custom + description: Number of documents that would be sent + type: long + + - name: metrics.diag_documents_volume.dns_events.suppressed_bytes + level: custom + description: Total size of suppressed documents + type: long + + - name: metrics.diag_documents_volume.dns_events.suppressed_count + level: custom + description: Number of suppressed documents + type: long + + - name: metrics.diag_documents_volume.overall.sent_bytes + level: custom + description: Total size of documents that would be sent + type: long + + - name: metrics.diag_documents_volume.overall.sent_count + level: custom + description: Number of documents that would be sent + type: long + + - name: metrics.diag_documents_volume.overall.suppressed_bytes + level: custom + description: Total size of suppressed documents + type: long + + - name: metrics.diag_documents_volume.overall.suppressed_count + level: custom + description: Number of suppressed documents + type: long + + - name: metrics.diag_documents_volume.process_events.sent_bytes + level: custom + description: Total size of documents that would be sent + type: long + + - name: metrics.diag_documents_volume.process_events.sent_count + level: custom + description: Number of documents that would be sent + type: long + + - name: metrics.diag_documents_volume.process_events.suppressed_bytes + level: custom + description: Total size of suppressed documents + type: long + + - name: metrics.diag_documents_volume.process_events.suppressed_count + level: custom + description: Number of suppressed documents + type: long + + - name: metrics.diag_documents_volume.process_events.sources + level: custom + type: object + description: An array of Process Event document statistics per source + + - name: metrics.diag_documents_volume.process_events.sources.source + level: custom + type: keyword + description: Process Event document source name + + - name: metrics.diag_documents_volume.process_events.sources.sent_count + level: custom + type: long + description: Number of Process Event documents from source that would be sent + + - name: metrics.diag_documents_volume.process_events.sources.sent_bytes + level: custom + type: long + description: Total size of Process Event documents from source that would be sent + + - name: metrics.diag_documents_volume.process_events.sources.suppressed_count + level: custom + type: long + description: Number of suppressed Process Event documents from source + + - name: metrics.diag_documents_volume.process_events.sources.suppressed_bytes + level: custom + type: long + description: Total size of suppressed Process Event documents from source + - name: metrics.documents_volume level: custom type: object diff --git a/package/endpoint/data_stream/metrics/fields/fields.yml b/package/endpoint/data_stream/metrics/fields/fields.yml index 2f99185f4..5c4d75a73 100644 --- a/package/endpoint/data_stream/metrics/fields/fields.yml +++ b/package/endpoint/data_stream/metrics/fields/fields.yml @@ -58,6 +58,102 @@ type: half_float description: Average CPU load used by the endpoint default_field: false + - name: metrics.diag_documents_volume + level: custom + type: object + description: Statistics about diagnostic documents + default_field: false + - name: metrics.diag_documents_volume.dns_events.sent_bytes + level: custom + type: long + description: Total size of documents that would be sent + default_field: false + - name: metrics.diag_documents_volume.dns_events.sent_count + level: custom + type: long + description: Number of documents that would be sent + default_field: false + - name: metrics.diag_documents_volume.dns_events.suppressed_bytes + level: custom + type: long + description: Total size of suppressed documents + default_field: false + - name: metrics.diag_documents_volume.dns_events.suppressed_count + level: custom + type: long + description: Number of suppressed documents + default_field: false + - name: metrics.diag_documents_volume.overall.sent_bytes + level: custom + type: long + description: Total size of documents that would be sent + default_field: false + - name: metrics.diag_documents_volume.overall.sent_count + level: custom + type: long + description: Number of documents that would be sent + default_field: false + - name: metrics.diag_documents_volume.overall.suppressed_bytes + level: custom + type: long + description: Total size of suppressed documents + default_field: false + - name: metrics.diag_documents_volume.overall.suppressed_count + level: custom + type: long + description: Number of suppressed documents + default_field: false + - name: metrics.diag_documents_volume.process_events.sent_bytes + level: custom + type: long + description: Total size of documents that would be sent + default_field: false + - name: metrics.diag_documents_volume.process_events.sent_count + level: custom + type: long + description: Number of documents that would be sent + default_field: false + - name: metrics.diag_documents_volume.process_events.sources + level: custom + type: object + description: An array of Process Event document statistics per source + default_field: false + - name: metrics.diag_documents_volume.process_events.sources.sent_bytes + level: custom + type: long + description: Total size of Process Event documents from source that would be sent + default_field: false + - name: metrics.diag_documents_volume.process_events.sources.sent_count + level: custom + type: long + description: Number of Process Event documents from source that would be sent + default_field: false + - name: metrics.diag_documents_volume.process_events.sources.source + level: custom + type: keyword + ignore_above: 1024 + description: Process Event document source name + default_field: false + - name: metrics.diag_documents_volume.process_events.sources.suppressed_bytes + level: custom + type: long + description: Total size of suppressed Process Event documents from source + default_field: false + - name: metrics.diag_documents_volume.process_events.sources.suppressed_count + level: custom + type: long + description: Number of suppressed Process Event documents from source + default_field: false + - name: metrics.diag_documents_volume.process_events.suppressed_bytes + level: custom + type: long + description: Total size of suppressed documents + default_field: false + - name: metrics.diag_documents_volume.process_events.suppressed_count + level: custom + type: long + description: Number of suppressed documents + default_field: false - name: metrics.disks level: custom type: object diff --git a/package/endpoint/docs/README.md b/package/endpoint/docs/README.md index fde55412f..43ad894a1 100644 --- a/package/endpoint/docs/README.md +++ b/package/endpoint/docs/README.md @@ -3170,6 +3170,25 @@ Metrics documents contain performance information about the endpoint executable | Endpoint.metrics.cpu.endpoint.histogram | This field defines an elasticsearch histogram field (https://www.elastic.co/guide/en/elasticsearch/reference/current/histogram.html#histogram) The values field includes 20 buckets (each bucket is 5%) representing the cpu usage The counts field includes 20 buckets of how many times the endpoint's cpu usage fell into each bucket | histogram | | Endpoint.metrics.cpu.endpoint.latest | Average CPU over the last sample interval | half_float | | Endpoint.metrics.cpu.endpoint.mean | Average CPU load used by the endpoint | half_float | +| Endpoint.metrics.diag_documents_volume | Statistics about diagnostic documents | object | +| Endpoint.metrics.diag_documents_volume.dns_events.sent_bytes | Total size of documents that would be sent | long | +| Endpoint.metrics.diag_documents_volume.dns_events.sent_count | Number of documents that would be sent | long | +| Endpoint.metrics.diag_documents_volume.dns_events.suppressed_bytes | Total size of suppressed documents | long | +| Endpoint.metrics.diag_documents_volume.dns_events.suppressed_count | Number of suppressed documents | long | +| Endpoint.metrics.diag_documents_volume.overall.sent_bytes | Total size of documents that would be sent | long | +| Endpoint.metrics.diag_documents_volume.overall.sent_count | Number of documents that would be sent | long | +| Endpoint.metrics.diag_documents_volume.overall.suppressed_bytes | Total size of suppressed documents | long | +| Endpoint.metrics.diag_documents_volume.overall.suppressed_count | Number of suppressed documents | long | +| Endpoint.metrics.diag_documents_volume.process_events.sent_bytes | Total size of documents that would be sent | long | +| Endpoint.metrics.diag_documents_volume.process_events.sent_count | Number of documents that would be sent | long | +| Endpoint.metrics.diag_documents_volume.process_events.sources | An array of Process Event document statistics per source | object | +| Endpoint.metrics.diag_documents_volume.process_events.sources.sent_bytes | Total size of Process Event documents from source that would be sent | long | +| Endpoint.metrics.diag_documents_volume.process_events.sources.sent_count | Number of Process Event documents from source that would be sent | long | +| Endpoint.metrics.diag_documents_volume.process_events.sources.source | Process Event document source name | keyword | +| Endpoint.metrics.diag_documents_volume.process_events.sources.suppressed_bytes | Total size of suppressed Process Event documents from source | long | +| Endpoint.metrics.diag_documents_volume.process_events.sources.suppressed_count | Number of suppressed Process Event documents from source | long | +| Endpoint.metrics.diag_documents_volume.process_events.suppressed_bytes | Total size of suppressed documents | long | +| Endpoint.metrics.diag_documents_volume.process_events.suppressed_count | Number of suppressed documents | long | | Endpoint.metrics.documents_volume | Statistics about sent documents | object | | Endpoint.metrics.documents_volume.alerts.sent_bytes | Total size of sent documents | long | | Endpoint.metrics.documents_volume.alerts.sent_count | Number of sent documents | long | diff --git a/schemas/v1/metrics/metrics.yaml b/schemas/v1/metrics/metrics.yaml index a6ec90c2e..d19d57fe8 100644 --- a/schemas/v1/metrics/metrics.yaml +++ b/schemas/v1/metrics/metrics.yaml @@ -74,6 +74,178 @@ Endpoint.metrics.cpu.endpoint.mean: normalize: [] short: Average CPU load used by the endpoint type: half_float +Endpoint.metrics.diag_documents_volume: + dashed_name: Endpoint-metrics-diag-documents-volume + description: Statistics about diagnostic documents + flat_name: Endpoint.metrics.diag_documents_volume + level: custom + name: metrics.diag_documents_volume + normalize: [] + short: Statistics about diagnostic documents + type: object +Endpoint.metrics.diag_documents_volume.dns_events.sent_bytes: + dashed_name: Endpoint-metrics-diag-documents-volume-dns-events-sent-bytes + description: Total size of documents that would be sent + flat_name: Endpoint.metrics.diag_documents_volume.dns_events.sent_bytes + level: custom + name: metrics.diag_documents_volume.dns_events.sent_bytes + normalize: [] + short: Total size of documents that would be sent + type: long +Endpoint.metrics.diag_documents_volume.dns_events.sent_count: + dashed_name: Endpoint-metrics-diag-documents-volume-dns-events-sent-count + description: Number of documents that would be sent + flat_name: Endpoint.metrics.diag_documents_volume.dns_events.sent_count + level: custom + name: metrics.diag_documents_volume.dns_events.sent_count + normalize: [] + short: Number of documents that would be sent + type: long +Endpoint.metrics.diag_documents_volume.dns_events.suppressed_bytes: + dashed_name: Endpoint-metrics-diag-documents-volume-dns-events-suppressed-bytes + description: Total size of suppressed documents + flat_name: Endpoint.metrics.diag_documents_volume.dns_events.suppressed_bytes + level: custom + name: metrics.diag_documents_volume.dns_events.suppressed_bytes + normalize: [] + short: Total size of suppressed documents + type: long +Endpoint.metrics.diag_documents_volume.dns_events.suppressed_count: + dashed_name: Endpoint-metrics-diag-documents-volume-dns-events-suppressed-count + description: Number of suppressed documents + flat_name: Endpoint.metrics.diag_documents_volume.dns_events.suppressed_count + level: custom + name: metrics.diag_documents_volume.dns_events.suppressed_count + normalize: [] + short: Number of suppressed documents + type: long +Endpoint.metrics.diag_documents_volume.overall.sent_bytes: + dashed_name: Endpoint-metrics-diag-documents-volume-overall-sent-bytes + description: Total size of documents that would be sent + flat_name: Endpoint.metrics.diag_documents_volume.overall.sent_bytes + level: custom + name: metrics.diag_documents_volume.overall.sent_bytes + normalize: [] + short: Total size of documents that would be sent + type: long +Endpoint.metrics.diag_documents_volume.overall.sent_count: + dashed_name: Endpoint-metrics-diag-documents-volume-overall-sent-count + description: Number of documents that would be sent + flat_name: Endpoint.metrics.diag_documents_volume.overall.sent_count + level: custom + name: metrics.diag_documents_volume.overall.sent_count + normalize: [] + short: Number of documents that would be sent + type: long +Endpoint.metrics.diag_documents_volume.overall.suppressed_bytes: + dashed_name: Endpoint-metrics-diag-documents-volume-overall-suppressed-bytes + description: Total size of suppressed documents + flat_name: Endpoint.metrics.diag_documents_volume.overall.suppressed_bytes + level: custom + name: metrics.diag_documents_volume.overall.suppressed_bytes + normalize: [] + short: Total size of suppressed documents + type: long +Endpoint.metrics.diag_documents_volume.overall.suppressed_count: + dashed_name: Endpoint-metrics-diag-documents-volume-overall-suppressed-count + description: Number of suppressed documents + flat_name: Endpoint.metrics.diag_documents_volume.overall.suppressed_count + level: custom + name: metrics.diag_documents_volume.overall.suppressed_count + normalize: [] + short: Number of suppressed documents + type: long +Endpoint.metrics.diag_documents_volume.process_events.sent_bytes: + dashed_name: Endpoint-metrics-diag-documents-volume-process-events-sent-bytes + description: Total size of documents that would be sent + flat_name: Endpoint.metrics.diag_documents_volume.process_events.sent_bytes + level: custom + name: metrics.diag_documents_volume.process_events.sent_bytes + normalize: [] + short: Total size of documents that would be sent + type: long +Endpoint.metrics.diag_documents_volume.process_events.sent_count: + dashed_name: Endpoint-metrics-diag-documents-volume-process-events-sent-count + description: Number of documents that would be sent + flat_name: Endpoint.metrics.diag_documents_volume.process_events.sent_count + level: custom + name: metrics.diag_documents_volume.process_events.sent_count + normalize: [] + short: Number of documents that would be sent + type: long +Endpoint.metrics.diag_documents_volume.process_events.sources: + dashed_name: Endpoint-metrics-diag-documents-volume-process-events-sources + description: An array of Process Event document statistics per source + flat_name: Endpoint.metrics.diag_documents_volume.process_events.sources + level: custom + name: metrics.diag_documents_volume.process_events.sources + normalize: [] + short: An array of Process Event document statistics per source + type: object +Endpoint.metrics.diag_documents_volume.process_events.sources.sent_bytes: + dashed_name: Endpoint-metrics-diag-documents-volume-process-events-sources-sent-bytes + description: Total size of Process Event documents from source that would be sent + flat_name: Endpoint.metrics.diag_documents_volume.process_events.sources.sent_bytes + level: custom + name: metrics.diag_documents_volume.process_events.sources.sent_bytes + normalize: [] + short: Total size of Process Event documents from source that would be sent + type: long +Endpoint.metrics.diag_documents_volume.process_events.sources.sent_count: + dashed_name: Endpoint-metrics-diag-documents-volume-process-events-sources-sent-count + description: Number of Process Event documents from source that would be sent + flat_name: Endpoint.metrics.diag_documents_volume.process_events.sources.sent_count + level: custom + name: metrics.diag_documents_volume.process_events.sources.sent_count + normalize: [] + short: Number of Process Event documents from source that would be sent + type: long +Endpoint.metrics.diag_documents_volume.process_events.sources.source: + dashed_name: Endpoint-metrics-diag-documents-volume-process-events-sources-source + description: Process Event document source name + flat_name: Endpoint.metrics.diag_documents_volume.process_events.sources.source + ignore_above: 1024 + level: custom + name: metrics.diag_documents_volume.process_events.sources.source + normalize: [] + short: Process Event document source name + type: keyword +Endpoint.metrics.diag_documents_volume.process_events.sources.suppressed_bytes: + dashed_name: Endpoint-metrics-diag-documents-volume-process-events-sources-suppressed-bytes + description: Total size of suppressed Process Event documents from source + flat_name: Endpoint.metrics.diag_documents_volume.process_events.sources.suppressed_bytes + level: custom + name: metrics.diag_documents_volume.process_events.sources.suppressed_bytes + normalize: [] + short: Total size of suppressed Process Event documents from source + type: long +Endpoint.metrics.diag_documents_volume.process_events.sources.suppressed_count: + dashed_name: Endpoint-metrics-diag-documents-volume-process-events-sources-suppressed-count + description: Number of suppressed Process Event documents from source + flat_name: Endpoint.metrics.diag_documents_volume.process_events.sources.suppressed_count + level: custom + name: metrics.diag_documents_volume.process_events.sources.suppressed_count + normalize: [] + short: Number of suppressed Process Event documents from source + type: long +Endpoint.metrics.diag_documents_volume.process_events.suppressed_bytes: + dashed_name: Endpoint-metrics-diag-documents-volume-process-events-suppressed-bytes + description: Total size of suppressed documents + flat_name: Endpoint.metrics.diag_documents_volume.process_events.suppressed_bytes + level: custom + name: metrics.diag_documents_volume.process_events.suppressed_bytes + normalize: [] + short: Total size of suppressed documents + type: long +Endpoint.metrics.diag_documents_volume.process_events.suppressed_count: + dashed_name: Endpoint-metrics-diag-documents-volume-process-events-suppressed-count + description: Number of suppressed documents + flat_name: Endpoint.metrics.diag_documents_volume.process_events.suppressed_count + level: custom + name: metrics.diag_documents_volume.process_events.suppressed_count + normalize: [] + short: Number of suppressed documents + type: long Endpoint.metrics.disks: dashed_name: Endpoint-metrics-disks description: An array of disk information for the host From 691657b314ea78bb8b1eb9842145eb527374c9c9 Mon Sep 17 00:00:00 2001 From: Nicholas Berlin Date: Wed, 3 Jun 2026 14:49:24 -0400 Subject: [PATCH 2/2] Add missing event type sub-fields to diag_documents_volume Co-Authored-By: Claude Sonnet 4.6 --- custom_schemas/custom_endpoint.yml | 160 ++++++++++++++++ schemas/v1/metrics/metrics.yaml | 288 +++++++++++++++++++++++++++++ 2 files changed, 448 insertions(+) diff --git a/custom_schemas/custom_endpoint.yml b/custom_schemas/custom_endpoint.yml index 71bd5410b..c812eef0f 100644 --- a/custom_schemas/custom_endpoint.yml +++ b/custom_schemas/custom_endpoint.yml @@ -555,6 +555,166 @@ type: long description: Total size of suppressed Process Event documents from source + - name: metrics.diag_documents_volume.alerts.sent_bytes + level: custom + description: Total size of documents that would be sent + type: long + + - name: metrics.diag_documents_volume.alerts.sent_count + level: custom + description: Number of documents that would be sent + type: long + + - name: metrics.diag_documents_volume.alerts.suppressed_bytes + level: custom + description: Total size of suppressed documents + type: long + + - name: metrics.diag_documents_volume.alerts.suppressed_count + level: custom + description: Number of suppressed documents + type: long + + - name: metrics.diag_documents_volume.api_events.sent_bytes + level: custom + description: Total size of documents that would be sent + type: long + + - name: metrics.diag_documents_volume.api_events.sent_count + level: custom + description: Number of documents that would be sent + type: long + + - name: metrics.diag_documents_volume.api_events.suppressed_bytes + level: custom + description: Total size of suppressed documents + type: long + + - name: metrics.diag_documents_volume.api_events.suppressed_count + level: custom + description: Number of suppressed documents + type: long + + - name: metrics.diag_documents_volume.diagnostic_alerts.sent_bytes + level: custom + description: Total size of documents that would be sent + type: long + + - name: metrics.diag_documents_volume.diagnostic_alerts.sent_count + level: custom + description: Number of documents that would be sent + type: long + + - name: metrics.diag_documents_volume.diagnostic_alerts.suppressed_bytes + level: custom + description: Total size of suppressed documents + type: long + + - name: metrics.diag_documents_volume.diagnostic_alerts.suppressed_count + level: custom + description: Number of suppressed documents + type: long + + - name: metrics.diag_documents_volume.file_events.sent_bytes + level: custom + description: Total size of documents that would be sent + type: long + + - name: metrics.diag_documents_volume.file_events.sent_count + level: custom + description: Number of documents that would be sent + type: long + + - name: metrics.diag_documents_volume.file_events.suppressed_bytes + level: custom + description: Total size of suppressed documents + type: long + + - name: metrics.diag_documents_volume.file_events.suppressed_count + level: custom + description: Number of suppressed documents + type: long + + - name: metrics.diag_documents_volume.library_events.sent_bytes + level: custom + description: Total size of documents that would be sent + type: long + + - name: metrics.diag_documents_volume.library_events.sent_count + level: custom + description: Number of documents that would be sent + type: long + + - name: metrics.diag_documents_volume.library_events.suppressed_bytes + level: custom + description: Total size of suppressed documents + type: long + + - name: metrics.diag_documents_volume.library_events.suppressed_count + level: custom + description: Number of suppressed documents + type: long + + - name: metrics.diag_documents_volume.network_events.sent_bytes + level: custom + description: Total size of documents that would be sent + type: long + + - name: metrics.diag_documents_volume.network_events.sent_count + level: custom + description: Number of documents that would be sent + type: long + + - name: metrics.diag_documents_volume.network_events.suppressed_bytes + level: custom + description: Total size of suppressed documents + type: long + + - name: metrics.diag_documents_volume.network_events.suppressed_count + level: custom + description: Number of suppressed documents + type: long + + - name: metrics.diag_documents_volume.registry_events.sent_bytes + level: custom + description: Total size of documents that would be sent + type: long + + - name: metrics.diag_documents_volume.registry_events.sent_count + level: custom + description: Number of documents that would be sent + type: long + + - name: metrics.diag_documents_volume.registry_events.suppressed_bytes + level: custom + description: Total size of suppressed documents + type: long + + - name: metrics.diag_documents_volume.registry_events.suppressed_count + level: custom + description: Number of suppressed documents + type: long + + - name: metrics.diag_documents_volume.security_events.sent_bytes + level: custom + description: Total size of documents that would be sent + type: long + + - name: metrics.diag_documents_volume.security_events.sent_count + level: custom + description: Number of documents that would be sent + type: long + + - name: metrics.diag_documents_volume.security_events.suppressed_bytes + level: custom + description: Total size of suppressed documents + type: long + + - name: metrics.diag_documents_volume.security_events.suppressed_count + level: custom + description: Number of suppressed documents + type: long + - name: metrics.documents_volume level: custom type: object diff --git a/schemas/v1/metrics/metrics.yaml b/schemas/v1/metrics/metrics.yaml index d19d57fe8..82a481e09 100644 --- a/schemas/v1/metrics/metrics.yaml +++ b/schemas/v1/metrics/metrics.yaml @@ -246,6 +246,294 @@ Endpoint.metrics.diag_documents_volume.process_events.suppressed_count: normalize: [] short: Number of suppressed documents type: long +Endpoint.metrics.diag_documents_volume.alerts.sent_bytes: + dashed_name: Endpoint-metrics-diag-documents-volume-alerts-sent-bytes + description: Total size of documents that would be sent + flat_name: Endpoint.metrics.diag_documents_volume.alerts.sent_bytes + level: custom + name: metrics.diag_documents_volume.alerts.sent_bytes + normalize: [] + short: Total size of documents that would be sent + type: long +Endpoint.metrics.diag_documents_volume.alerts.sent_count: + dashed_name: Endpoint-metrics-diag-documents-volume-alerts-sent-count + description: Number of documents that would be sent + flat_name: Endpoint.metrics.diag_documents_volume.alerts.sent_count + level: custom + name: metrics.diag_documents_volume.alerts.sent_count + normalize: [] + short: Number of documents that would be sent + type: long +Endpoint.metrics.diag_documents_volume.alerts.suppressed_bytes: + dashed_name: Endpoint-metrics-diag-documents-volume-alerts-suppressed-bytes + description: Total size of suppressed documents + flat_name: Endpoint.metrics.diag_documents_volume.alerts.suppressed_bytes + level: custom + name: metrics.diag_documents_volume.alerts.suppressed_bytes + normalize: [] + short: Total size of suppressed documents + type: long +Endpoint.metrics.diag_documents_volume.alerts.suppressed_count: + dashed_name: Endpoint-metrics-diag-documents-volume-alerts-suppressed-count + description: Number of suppressed documents + flat_name: Endpoint.metrics.diag_documents_volume.alerts.suppressed_count + level: custom + name: metrics.diag_documents_volume.alerts.suppressed_count + normalize: [] + short: Number of suppressed documents + type: long +Endpoint.metrics.diag_documents_volume.api_events.sent_bytes: + dashed_name: Endpoint-metrics-diag-documents-volume-api-events-sent-bytes + description: Total size of documents that would be sent + flat_name: Endpoint.metrics.diag_documents_volume.api_events.sent_bytes + level: custom + name: metrics.diag_documents_volume.api_events.sent_bytes + normalize: [] + short: Total size of documents that would be sent + type: long +Endpoint.metrics.diag_documents_volume.api_events.sent_count: + dashed_name: Endpoint-metrics-diag-documents-volume-api-events-sent-count + description: Number of documents that would be sent + flat_name: Endpoint.metrics.diag_documents_volume.api_events.sent_count + level: custom + name: metrics.diag_documents_volume.api_events.sent_count + normalize: [] + short: Number of documents that would be sent + type: long +Endpoint.metrics.diag_documents_volume.api_events.suppressed_bytes: + dashed_name: Endpoint-metrics-diag-documents-volume-api-events-suppressed-bytes + description: Total size of suppressed documents + flat_name: Endpoint.metrics.diag_documents_volume.api_events.suppressed_bytes + level: custom + name: metrics.diag_documents_volume.api_events.suppressed_bytes + normalize: [] + short: Total size of suppressed documents + type: long +Endpoint.metrics.diag_documents_volume.api_events.suppressed_count: + dashed_name: Endpoint-metrics-diag-documents-volume-api-events-suppressed-count + description: Number of suppressed documents + flat_name: Endpoint.metrics.diag_documents_volume.api_events.suppressed_count + level: custom + name: metrics.diag_documents_volume.api_events.suppressed_count + normalize: [] + short: Number of suppressed documents + type: long +Endpoint.metrics.diag_documents_volume.diagnostic_alerts.sent_bytes: + dashed_name: Endpoint-metrics-diag-documents-volume-diagnostic-alerts-sent-bytes + description: Total size of documents that would be sent + flat_name: Endpoint.metrics.diag_documents_volume.diagnostic_alerts.sent_bytes + level: custom + name: metrics.diag_documents_volume.diagnostic_alerts.sent_bytes + normalize: [] + short: Total size of documents that would be sent + type: long +Endpoint.metrics.diag_documents_volume.diagnostic_alerts.sent_count: + dashed_name: Endpoint-metrics-diag-documents-volume-diagnostic-alerts-sent-count + description: Number of documents that would be sent + flat_name: Endpoint.metrics.diag_documents_volume.diagnostic_alerts.sent_count + level: custom + name: metrics.diag_documents_volume.diagnostic_alerts.sent_count + normalize: [] + short: Number of documents that would be sent + type: long +Endpoint.metrics.diag_documents_volume.diagnostic_alerts.suppressed_bytes: + dashed_name: Endpoint-metrics-diag-documents-volume-diagnostic-alerts-suppressed-bytes + description: Total size of suppressed documents + flat_name: Endpoint.metrics.diag_documents_volume.diagnostic_alerts.suppressed_bytes + level: custom + name: metrics.diag_documents_volume.diagnostic_alerts.suppressed_bytes + normalize: [] + short: Total size of suppressed documents + type: long +Endpoint.metrics.diag_documents_volume.diagnostic_alerts.suppressed_count: + dashed_name: Endpoint-metrics-diag-documents-volume-diagnostic-alerts-suppressed-count + description: Number of suppressed documents + flat_name: Endpoint.metrics.diag_documents_volume.diagnostic_alerts.suppressed_count + level: custom + name: metrics.diag_documents_volume.diagnostic_alerts.suppressed_count + normalize: [] + short: Number of suppressed documents + type: long +Endpoint.metrics.diag_documents_volume.file_events.sent_bytes: + dashed_name: Endpoint-metrics-diag-documents-volume-file-events-sent-bytes + description: Total size of documents that would be sent + flat_name: Endpoint.metrics.diag_documents_volume.file_events.sent_bytes + level: custom + name: metrics.diag_documents_volume.file_events.sent_bytes + normalize: [] + short: Total size of documents that would be sent + type: long +Endpoint.metrics.diag_documents_volume.file_events.sent_count: + dashed_name: Endpoint-metrics-diag-documents-volume-file-events-sent-count + description: Number of documents that would be sent + flat_name: Endpoint.metrics.diag_documents_volume.file_events.sent_count + level: custom + name: metrics.diag_documents_volume.file_events.sent_count + normalize: [] + short: Number of documents that would be sent + type: long +Endpoint.metrics.diag_documents_volume.file_events.suppressed_bytes: + dashed_name: Endpoint-metrics-diag-documents-volume-file-events-suppressed-bytes + description: Total size of suppressed documents + flat_name: Endpoint.metrics.diag_documents_volume.file_events.suppressed_bytes + level: custom + name: metrics.diag_documents_volume.file_events.suppressed_bytes + normalize: [] + short: Total size of suppressed documents + type: long +Endpoint.metrics.diag_documents_volume.file_events.suppressed_count: + dashed_name: Endpoint-metrics-diag-documents-volume-file-events-suppressed-count + description: Number of suppressed documents + flat_name: Endpoint.metrics.diag_documents_volume.file_events.suppressed_count + level: custom + name: metrics.diag_documents_volume.file_events.suppressed_count + normalize: [] + short: Number of suppressed documents + type: long +Endpoint.metrics.diag_documents_volume.library_events.sent_bytes: + dashed_name: Endpoint-metrics-diag-documents-volume-library-events-sent-bytes + description: Total size of documents that would be sent + flat_name: Endpoint.metrics.diag_documents_volume.library_events.sent_bytes + level: custom + name: metrics.diag_documents_volume.library_events.sent_bytes + normalize: [] + short: Total size of documents that would be sent + type: long +Endpoint.metrics.diag_documents_volume.library_events.sent_count: + dashed_name: Endpoint-metrics-diag-documents-volume-library-events-sent-count + description: Number of documents that would be sent + flat_name: Endpoint.metrics.diag_documents_volume.library_events.sent_count + level: custom + name: metrics.diag_documents_volume.library_events.sent_count + normalize: [] + short: Number of documents that would be sent + type: long +Endpoint.metrics.diag_documents_volume.library_events.suppressed_bytes: + dashed_name: Endpoint-metrics-diag-documents-volume-library-events-suppressed-bytes + description: Total size of suppressed documents + flat_name: Endpoint.metrics.diag_documents_volume.library_events.suppressed_bytes + level: custom + name: metrics.diag_documents_volume.library_events.suppressed_bytes + normalize: [] + short: Total size of suppressed documents + type: long +Endpoint.metrics.diag_documents_volume.library_events.suppressed_count: + dashed_name: Endpoint-metrics-diag-documents-volume-library-events-suppressed-count + description: Number of suppressed documents + flat_name: Endpoint.metrics.diag_documents_volume.library_events.suppressed_count + level: custom + name: metrics.diag_documents_volume.library_events.suppressed_count + normalize: [] + short: Number of suppressed documents + type: long +Endpoint.metrics.diag_documents_volume.network_events.sent_bytes: + dashed_name: Endpoint-metrics-diag-documents-volume-network-events-sent-bytes + description: Total size of documents that would be sent + flat_name: Endpoint.metrics.diag_documents_volume.network_events.sent_bytes + level: custom + name: metrics.diag_documents_volume.network_events.sent_bytes + normalize: [] + short: Total size of documents that would be sent + type: long +Endpoint.metrics.diag_documents_volume.network_events.sent_count: + dashed_name: Endpoint-metrics-diag-documents-volume-network-events-sent-count + description: Number of documents that would be sent + flat_name: Endpoint.metrics.diag_documents_volume.network_events.sent_count + level: custom + name: metrics.diag_documents_volume.network_events.sent_count + normalize: [] + short: Number of documents that would be sent + type: long +Endpoint.metrics.diag_documents_volume.network_events.suppressed_bytes: + dashed_name: Endpoint-metrics-diag-documents-volume-network-events-suppressed-bytes + description: Total size of suppressed documents + flat_name: Endpoint.metrics.diag_documents_volume.network_events.suppressed_bytes + level: custom + name: metrics.diag_documents_volume.network_events.suppressed_bytes + normalize: [] + short: Total size of suppressed documents + type: long +Endpoint.metrics.diag_documents_volume.network_events.suppressed_count: + dashed_name: Endpoint-metrics-diag-documents-volume-network-events-suppressed-count + description: Number of suppressed documents + flat_name: Endpoint.metrics.diag_documents_volume.network_events.suppressed_count + level: custom + name: metrics.diag_documents_volume.network_events.suppressed_count + normalize: [] + short: Number of suppressed documents + type: long +Endpoint.metrics.diag_documents_volume.registry_events.sent_bytes: + dashed_name: Endpoint-metrics-diag-documents-volume-registry-events-sent-bytes + description: Total size of documents that would be sent + flat_name: Endpoint.metrics.diag_documents_volume.registry_events.sent_bytes + level: custom + name: metrics.diag_documents_volume.registry_events.sent_bytes + normalize: [] + short: Total size of documents that would be sent + type: long +Endpoint.metrics.diag_documents_volume.registry_events.sent_count: + dashed_name: Endpoint-metrics-diag-documents-volume-registry-events-sent-count + description: Number of documents that would be sent + flat_name: Endpoint.metrics.diag_documents_volume.registry_events.sent_count + level: custom + name: metrics.diag_documents_volume.registry_events.sent_count + normalize: [] + short: Number of documents that would be sent + type: long +Endpoint.metrics.diag_documents_volume.registry_events.suppressed_bytes: + dashed_name: Endpoint-metrics-diag-documents-volume-registry-events-suppressed-bytes + description: Total size of suppressed documents + flat_name: Endpoint.metrics.diag_documents_volume.registry_events.suppressed_bytes + level: custom + name: metrics.diag_documents_volume.registry_events.suppressed_bytes + normalize: [] + short: Total size of suppressed documents + type: long +Endpoint.metrics.diag_documents_volume.registry_events.suppressed_count: + dashed_name: Endpoint-metrics-diag-documents-volume-registry-events-suppressed-count + description: Number of suppressed documents + flat_name: Endpoint.metrics.diag_documents_volume.registry_events.suppressed_count + level: custom + name: metrics.diag_documents_volume.registry_events.suppressed_count + normalize: [] + short: Number of suppressed documents + type: long +Endpoint.metrics.diag_documents_volume.security_events.sent_bytes: + dashed_name: Endpoint-metrics-diag-documents-volume-security-events-sent-bytes + description: Total size of documents that would be sent + flat_name: Endpoint.metrics.diag_documents_volume.security_events.sent_bytes + level: custom + name: metrics.diag_documents_volume.security_events.sent_bytes + normalize: [] + short: Total size of documents that would be sent + type: long +Endpoint.metrics.diag_documents_volume.security_events.sent_count: + dashed_name: Endpoint-metrics-diag-documents-volume-security-events-sent-count + description: Number of documents that would be sent + flat_name: Endpoint.metrics.diag_documents_volume.security_events.sent_count + level: custom + name: metrics.diag_documents_volume.security_events.sent_count + normalize: [] + short: Number of documents that would be sent + type: long +Endpoint.metrics.diag_documents_volume.security_events.suppressed_bytes: + dashed_name: Endpoint-metrics-diag-documents-volume-security-events-suppressed-bytes + description: Total size of suppressed documents + flat_name: Endpoint.metrics.diag_documents_volume.security_events.suppressed_bytes + level: custom + name: metrics.diag_documents_volume.security_events.suppressed_bytes + normalize: [] + short: Total size of suppressed documents + type: long +Endpoint.metrics.diag_documents_volume.security_events.suppressed_count: + dashed_name: Endpoint-metrics-diag-documents-volume-security-events-suppressed-count + description: Number of suppressed documents + flat_name: Endpoint.metrics.diag_documents_volume.security_events.suppressed_count + level: custom + name: metrics.diag_documents_volume.security_events.suppressed_count + normalize: [] + short: Number of suppressed documents + type: long Endpoint.metrics.disks: dashed_name: Endpoint-metrics-disks description: An array of disk information for the host