Skip to content

Correlator metrics

The following metrics are specific for LogMan.io Correlator. Detections (also known as correlation rules) are based on the Correlator microservice.

Naming and tags in Grafana and InfluxDB

  • Correlator metrics groups are under the measurement tag.
  • Correlator metrics are only produced for the Correlator microservice (tag appclass) and can be further filtered with the additional tags correlator to isolate a single correlator, and host.
  • Each individual metric (for example, in) is a value in the field tag.

correlator.predicate

A counter metric that counts how many events went through the predicate section, or filter, of a detection. Each metric updates once per minute, so time interval refers to the period of about one minute.

  • in: Number events entering the predicate in the time interval.
  • hit: Number events successfully matching the predicate (fulfilling the conditions of the filter) in the time interval.
  • miss: Number events missing the predicate in the time interval (not fulfilling the conditions of the filter) and thus leaving the Correlator.
  • error: Number of errors in the predicate in the time interval.

correlator.trigger

A counter metric that counts how many events went through the trigger section of the correlator. The trigger defines and carries out an action. Each metric updates once per minute, so time interval refers to the period of about one minute.

  • in: Number events entering the trigger in the time interval.
  • out: Number events leaving the trigger in the time interval.
  • error: Number of errors in the trigger in the time interval, should be equal to in minus out.

correlator.time

A counter metric that records processing time in seconds spent in each phase of a detection. Values are cumulative within the metrics interval (about one minute). The Correlator samples every Nth event (default N = 10) and scales durations so totals stay representative; override with [correlator] time_metrics_sample_interval.

Tags: correlator (sanitized define.name), path (Library file path), tenant.

Field Phase
total Entire process() path for the rule
predicate predicate filter
evaluate evaluate (window correlator)
analyze analyze (window correlator)
trigger trigger

These fields are shown on the Detections screen in LogMan.io (timetotal, timepredicate, timeevaluate, timeanalyze, timetrigger). Analysts use that UI for per-rule tuning; Grafana is used for Kafka consumer lag per Correlator instance, not for these time fields. See Monitoring detection performance.