Add docs about the Hosts metrics tab (#3939)

* Add docs about the Hosts metrics tab

* Comment out section about inspect option

* Remove outdated TODO

docs/en/observability/monitor-infra/analyze-hosts.asciidoc

@@ -30,7 +30,8 @@ include::view-infrastructure-metrics.asciidoc[tag=add-metrics-tip]
 The **Hosts** page provides several ways to view host metrics:
 
 * Overview tiles show the number of hosts returned by your search plus
-averages of key metrics, including CPU usage, memory usage, and throughput.
+averages of key metrics, including CPU usage, normalized load, and memory usage.
+Max disk usage is also shown.
 * The Host limit controls the maximum number of hosts shown on the page. The
 default is 50, which means the page shows data for the top 50 hosts based on the
 most recent timestamps. You can increase the host limit to see data for more
@@ -39,7 +40,7 @@ hosts, but doing so may impact query performance.
 for any hosts with active alerts. You may need to page through the list
 or change the number of rows displayed on each page to see all of your hosts.
 * Each host name is an active link to a <<view-host-details, host details>> page,
-which includes metrics, host metadata, alerts, processes, logs, and anomalies.
+where you can explore enhanced metrics and other observability data related to the selected host.
 You can optionally open the host details in an overlay.
 * Table columns are sortable, but note that the sorting behavior is applied to
 the already returned data set.
@@ -85,14 +86,16 @@ To learn more about filtering data in {kib}, refer to
 [[analyze-hosts-inspect-data]]
 == View metrics
 
-On the **Metrics** tab, view metrics trending over time, including normalized load,
-CPU usage, memory usage, network inbound, network outbound, disk read IOPS, and
-disk write IOPS. Place your cursor over a line to view metrics at a specific
-point in time. From within each visualization, you can choose to inspect
-and download the metrics or open the visualization in Lens.
+On the **Metrics** tab, view metrics trending over time, including CPU usage,
+normalized load, memory usage, disk usage, and other metrics related to disk IOPs and throughput.
+Place your cursor over a line to view metrics at a specific
+point in time. From within each visualization, you can choose to open the visualization in Lens.
 
 To see metrics for a specific host, refer to <<view-host-details>>.
 
+//TODO: Uncomment this section if/when the inspect option feature is added back in.
+
+/////
 [discrete]
 [[inspect-metrics]]
 === Inspect and download metrics
@@ -114,6 +117,7 @@ Notice that you can change the view to **View: Requests** to explore the request
 used to fetch the data and the response returned from {es}. You can click links
 to further inspect and analyze the request in the **Dev Console** or
 **Search Profiler**.
+/////
 
 [discrete]
 [[analyze-hosts-open-in-lens]]
@@ -199,8 +203,7 @@ The host details overlay contains the following tabs:
 
 include::host-details-partial.asciidoc[]
 
-NOTE: These metrics are also available when viewing hosts on the **Inventory**
-page.
+NOTE: The metrics shown on the **Hosts** page are also available when viewing hosts on the **Inventory** page.
 
 [discrete]
 [[analyze-hosts-why-dashed-lines]]

docs/en/observability/monitor-infra/host-details-partial.asciidoc

@@ -3,42 +3,51 @@
 .*Overview*
 ====
 
-[role="screenshot"]
-image::images/metrics-overlay.png[Host metrics]
-
-The *Overview* tab displays metrics about the selected host, including CPU usage,
-normalized load, memory usage, disk usage, network traffic, and the log rate.
+The *Overview* tab displays key metrics about the selected host, such as CPU usage,
+normalized load, memory usage, and max disk usage.
 
 Change the time range to view metrics over a specific period of time.
 
+Expand each section to view more detail related to the selected host, such as metadata,
+active alerts, services detected on the host, and metrics.
+
 Hover over a specific time period on a chart to compare the various metrics at that given time.
 
-Expand the **Alerts** section to see alerts related to the selected host.
+Click **Show all** to drill down into related data.
 
+[role="screenshot"]
+image::images/overview-overlay.png[Host overview]
 ====
 
 [%collapsible]
 .*Metadata*
 ====
 
-[role="screenshot"]
-image::images/metadata-overlay.png[Host metadata]
-
 The *Metadata* tab lists all the meta information relating to the host:
 
 * Host information
 * Cloud information
 * Agent information
 
 All of this information can help when investigating events—for example, filtering by operating system or architecture.
+
+[role="screenshot"]
+image::images/metadata-overlay.png[Host metadata]
 ====
 
 [%collapsible]
-.*Processes*
+.*Metrics*
 ====
 
+The *Metrics* tab shows host metrics organized by type and is more complete than the view available in the *Overview* tab.
+
 [role="screenshot"]
-image::images/processes-overlay.png[Host processes]
+image::images/metrics-overlay.png[Metrics]
+====
+
+[%collapsible]
+.*Processes*
+====
 
 The *Processes* tab lists the total number of processes (`system.process.summary.total`) running on the host,
 along with the total number of processes in these various states:
@@ -66,15 +75,15 @@ The number of top processes is controlled by `process.include_top_n.by_cpu` and
 `idle`, `zombie`, and `unknown`.
 
 |===
+
+[role="screenshot"]
+image::images/processes-overlay.png[Host processes]
 ====
 
 [%collapsible]
 .*Universal Profiling*
 ====
 
-[role="screenshot"]
-image::images/universal-profiling-overlay.png[Host Universal Profiling]
-
 The *Universal Profiling* tab shows CPU usage down to the application code level.
 From here, you can find the sources of resource usage, and identify code that can be optimized to reduce infrastructure costs.
 The Universal Profiling tab has the following views.
@@ -89,15 +98,15 @@ The Universal Profiling tab has the following views.
 
 For more on Universal Profiling, refer to the <<universal-profiling, Universal Profiling>> docs.
 
+[role="screenshot"]
+image::images/universal-profiling-overlay.png[Host Universal Profiling]
+
 ====
 
 [%collapsible]
 .*Logs*
 ====
 
-[role="screenshot"]
-image::images/logs-overlay.png[Host logs]
-
 The *Logs* tab displays logs relating to the host that you have selected. By default, the logs tab displays the following columns.
 
 |===
@@ -114,16 +123,16 @@ base field, `message`, is used.
 You can customize the logs view by adding a column for an arbitrary field you would like
 to filter by. For more information, refer to <<customize-stream-page,Customize Stream>>.
 To view the logs in the {logs-app} for a detailed analysis, click *Open in Logs*.
+
+[role="screenshot"]
+image::images/logs-overlay.png[Host logs]
 ====
 
 [%collapsible]
 .*Anomalies*
 ====
 
-[role="screenshot"]
-image::images/anomalies-overlay.png[Anomalies]
-
-The *Anomalies* table displays a list of each single metric {anomaly-detect} job for the specific host. By default, anomaly
+The *Anomalies* tab displays a list of each single metric {anomaly-detect} job for the specific host. By default, anomaly
 jobs are sorted by time, showing the most recent jobs first.
 
 Along with the name of each anomaly job, detected anomalies with a severity score equal to 50, or higher, are listed. These
@@ -133,6 +142,9 @@ the actual value and the expected ("typical") value of the host metric in the an
 To drill down and analyze the metric anomaly, select *Actions -> Open in Anomaly Explorer* to view the
 {ml-docs}/ml-gs-results.html[Anomaly Explorer in {ml-app}]. You can also select *Actions -> Show in Inventory* to view the host
 Inventory page, filtered by the specific metric.
+
+[role="screenshot"]
+image::images/anomalies-overlay.png[Anomalies]
 ====
 
 [%collapsible]
@@ -146,9 +158,6 @@ that includes the {integrations-docs}/osquery_manager.html[Osquery Manager]
 integration and have Osquery {kibana-ref}/kibana-privileges.html[{kib} privileges] as a user.
 =====
 
-[role="screenshot"]
-image::images/osquery-overlay.png[Osquery]
-
 The *Osquery* tab allows you to build SQL statements to query your host data.
 You can create and run live or saved queries against
 the {agent}. Osquery results are stored in {es}
@@ -172,4 +181,7 @@ Other options include:
 * View the results in full screen mode.
 * Add, remove, reorder, and resize columns.
 * Sort field names in ascending or descending order.
+
+[role="screenshot"]
+image::images/osquery-overlay.png[Osquery]
 ====