[elastic_agent] Fix Agent Metrics "[Elastic Agent] CPU Usage" chart

[AndersonQ]

Proposed commit message

[elastic_agent] Fix Agent Metrics "[Elastic Agent] CPU Usage" chart


Fix the "[Elastic Agent] CPU Usage" dashboard panel to correctly calculate
CPU percentage regardless of the selected time window.

## Problem

The CPU usage formula used `interval()` to determine the time divisor when
calculating CPU percentage from cumulative CPU time:

    differences(max(system.process.cpu.total.time.ms)) / interval()

`interval()` returns the Kibana bucket interval (time window ÷ number of buckets),
not the actual time between consecutive data points. Since metrics are collected
at fixed intervals (e.g., every 60 seconds), but bucket intervals vary with the
selected time window, this caused:

- Correct values at small time windows (when bucket interval ≈ collection interval)
- Artificially low values at large time windows (when bucket interval > collection interval)

## Solution

Replace `interval()` with `counter_rate(max(@timestamp))` to calculate the actual
elapsed time between consecutive data points:

    counter_rate(max(system.process.cpu.total.time.ms)) / counter_rate(max(@timestamp))

`counter_rate()` instead of `differences()` as it automatically handles counter resets.

Checklist

• [ ] I have reviewed tips for building integrations and this pull request is aligned with them.
• [ ] I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• [ ] I have verified that Kibana version constraints are current according to guidelines.
• [ ] I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

• have a elastic stack deployed
• download this:
  scripts.tar.gz. It's a script to load mock data to ES
• configure the following env vars:

Variable	Description
ELASTIC_PACKAGE_ELASTICSEARCH_HOST	Elasticsearch URL (required)
ELASTIC_PACKAGE_ELASTICSEARCH_USERNAME	Username (optional)
ELASTIC_PACKAGE_ELASTICSEARCH_PASSWORD	Password (optional)

• extract it
• run import_index.sh
• build and install the elastic_agent integration from this PR:

cd packages/elastic_agent
elastic-package build -v
elastic-package install -v

• navigate to the "[Elastic Agent] Agent metrics" dashboard

• set the time to Jan 11, 2026 @ 23:00:00.000 -> Jan 13, 2026 @ 06:00:00.000

• select the mokona-elastic-mock agent

• play with the time range

• regardless of the chosen time range the CPU usage should stay constant

• the data on Jan 12 is a constant: All 4 components run at constant 10% CPU usage. Total: 40%

• the data for Jan 13 is variable:

  • Components elastic-agent and filebeat-default: 5% baseline, spike to 35% for 5 minutes every 30 minutes
  • Components metricbeat-default and fleet-server-default: 10% constant
  • Baseline total: 30% (5+5+10+10)
  • Spike total: 90% (35+35+10+10)

Related issues

• Closes [elastic_agent]: CPU Usage Inconsistency Based on Kibana Time Picker Selection #13321

Screenshots

[elasticmachine]

Pinging @elastic/elastic-agent (Team:Elastic-Agent)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 9de7d47

History

• 💔 Build #36387 failed 796267f
• 💔 Build #36385 failed e63bdf1
• 💔 Build #36384 failed 2d0fed2

cc @AndersonQ

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[belimawr]

It works, however when testing on an existing cluster (I installed the integration using Elastic-Package), the "Agent hostname" filter stopped working

Clicking on "View more" shows nothing.

I also managed to reproduce it with Elastic-Package and a 9.2.3 stack:

• Start Elastic-Package
• Create a policy and add an Elastic Agent
• Update the Elastic Agent integration
• Go to the dashboard

Could you take a look at it @AndersonQ? Maybe there was some small change in the filter that is incompatible with 9.2?

[AndersonQ]

It works, however when testing on an existing cluster (I installed the integration using Elastic-Package), the "Agent hostname" filter stopped working

Clicking on "View more" shows nothing.

I also managed to reproduce it with Elastic-Package and a 9.2.3 stack:

• Start Elastic-Package
• Create a policy and add an Elastic Agent
• Update the Elastic Agent integration
• Go to the dashboard

Could you take a look at it @AndersonQ? Maybe there was some small change in the filter that is incompatible with 9.2?

Interesting, I'll investigate. Thanks for catching that!