Hello,
I am having problem with aggregations. They don't seem to work with decimal numbers - it always returns 0.
If I change system.filesystem.used.pct to system.filesystem.files, it works.
Both system.filesystem.used.pct and system.filesystem.files are mapped as number.
Do you have any idea, how to fix it? Thanks
Metricbeat.yml
output:
logstash:
enabled: true
hosts:
- localhost:5045
timeout: 60
fields:
env: devel1
app: app1
metricbeat.modules:
- module: system
enabled: true
metricsets:
- filesystem # system.filesystem.used.pct
period: 60s
processors:
- drop_event.when.regexp:
system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|run|host|snap|tmp)($|/)'
Aggregation query
GET metrics*/_search
{
"aggs": {
"aggs_by_hostname": {
"aggs": {
"aggs_by_mount_point": {
"aggs": {
"system.filesystem.used.pct_max": {
"max": {
"field": "system.filesystem.used.pct"
}
}
},
"terms": {
"field": "system.filesystem.mount_point.keyword",
"size": 50
}
}
},
"terms": {
"field": "beat.hostname.keyword",
"size": 50
}
}
},
"query": {
"bool": {
"filter": {
"bool": {
"must": [
{
"range": {
"@timestamp": {
"gt": "2018-07-17T06:12:00Z",
"lte": "2018-07-17T06:14:00Z"
}
}
},
{
"exists": {
"field": "system.filesystem.used.pct"
}
}
]
}
}
}
}
}
Output (truncated some values):
{
"took": 0,
"timed_out": false,
"_shards": {
"total": 10,
"successful": 10,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 6,
"max_score": 0,
"hits": [
{
...
"system": {
"filesystem": {
"mount_point": "/boot",
"device_name": "/dev/nvme0n1p1",
"free": 582488064,
"used": {
"bytes": 155168768,
"pct": 0.2269
},
"available": 528838656,
"free_files": 46531,
"type": "ext4",
"files": 46848,
"total": 737656832
}
}
}
},
{
...
"system": {
"filesystem": {
"mount_point": "/",
"files": 31145984,
"free": 314722783232,
"used": {
"bytes": 186469289984,
"pct": 0.392
},
"free_files": 29989368,
"type": "ext4",
"available": 289192267776,
"device_name": "/dev/mapper/ubuntu--vg-root",
"total": 501192073216
}
}
},
{
"system": {
"filesystem": {
"mount_point": "/",
"device_name": "/dev/mapper/ubuntu--vg-root",
"files": 31145984,
"used": {
"bytes": 186469163008,
"pct": 0.392
},
"free_files": 29989450,
"available": 289192394752,
"type": "ext4",
"free": 314722910208,
"total": 501192073216
}
}
},
{
"system": {
"filesystem": {
"mount_point": "/boot",
"files": 46848,
"device_name": "/dev/nvme0n1p1",
"used": {
"pct": 0.2269,
"bytes": 155168768
},
"available": 528838656,
"type": "ext4",
"free_files": 46531,
"free": 582488064,
"total": 737656832
}
}
},
{
"system": {
"filesystem": {
"mount_point": "/boot",
"free": 582488064,
"device_name": "/dev/nvme0n1p1",
"used": {
"bytes": 155168768,
"pct": 0.2269
},
"free_files": 46531,
"type": "ext4",
"available": 528838656,
"files": 46848,
"total": 737656832
}
}
},
{
"system": {
"filesystem": {
"mount_point": "/",
"device_name": "/dev/mapper/ubuntu--vg-root",
"files": 31145984,
"used": {
"bytes": 186469019648,
"pct": 0.392
},
"free": 314723053568,
"type": "ext4",
"available": 289192538112,
"free_files": 29989396,
"total": 501192073216
}
}
}
]
},
"aggregations": {
"aggs_by_hostname": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "hostname.com",
"doc_count": 6,
"aggs_by_mount_point": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "/",
"doc_count": 3,
"system.filesystem.used.pct_max": {
"value": 0
}
},
{
"key": "/boot",
"doc_count": 3,
"system.filesystem.used.pct_max": {
"value": 0
}
}
]
}
}
]
}
}
}