#type=beat
| timechart(@host, limit=25, function=max(system.diskio.iostat.busy))

#type=beat system.cpu.idle.pct=*
| used:=100*(1-system.cpu.idle.pct/system.cpu.cores)
| timechart(@host, limit=25, function=avg(used))

#type=beat
| metricset.name="filesystem"
| eval(unavailable=100-(100*system.filesystem.available/system.filesystem.total)) | timechart(@host, function=min(unavailable),limit=50)

#type = beat
| groupby(kafka.partition.id, function=selectLast([kafka.partition.partition.insync_replica]))
| kafka.partition.partition.insync_replica = false
| count()

#type=beat system.load.1=* | timechart(@host, function=avg(system.load.1, as=load), limit=30)

#type=beat event.dataset = kafka.partition kafka.partition.partition.is_leader=true
| messages_in_partition := kafka.partition.offset.newest - kafka.partition.offset.oldest
| timechart(kafka.partition.partition.id, limit=24, function=min(messages_in_partition))