Aggregation doesn't work with decimal numbers


#1

Hello,

I am having problem with aggregations. They don't seem to work with decimal numbers - it always returns 0.
If I change system.filesystem.used.pct to system.filesystem.files, it works.
Both system.filesystem.used.pct and system.filesystem.files are mapped as number.

Do you have any idea, how to fix it? Thanks

Metricbeat.yml

output:
  logstash:
    enabled: true
    hosts:
      - localhost:5045
    timeout: 60

fields:
  env: devel1
  app: app1

metricbeat.modules:
- module: system
  enabled: true
  metricsets:
  - filesystem    # system.filesystem.used.pct
  period: 60s
  processors:
  - drop_event.when.regexp:
      system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|run|host|snap|tmp)($|/)'

Aggregation query

GET metrics*/_search
{
  "aggs": {
    "aggs_by_hostname": {
      "aggs": {
        "aggs_by_mount_point": {
          "aggs": {
            "system.filesystem.used.pct_max": {
              "max": {
                "field": "system.filesystem.used.pct"
              }
            }
          },
          "terms": {
            "field": "system.filesystem.mount_point.keyword",
            "size": 50
          }
        }
      },
      "terms": {
        "field": "beat.hostname.keyword",
        "size": 50
      }
    }
  },
  "query": {
    "bool": {
      "filter": {
        "bool": {
          "must": [
            {
              "range": {
                "@timestamp": {
                  "gt": "2018-07-17T06:12:00Z",
                  "lte": "2018-07-17T06:14:00Z"
                }
              }
            },
            {
              "exists": {
                "field": "system.filesystem.used.pct"
              }
            }
          ]
        }
      }
    }
  }
}

Output (truncated some values):

{
  "took": 0,
  "timed_out": false,
  "_shards": {
    "total": 10,
    "successful": 10,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 6,
    "max_score": 0,
    "hits": [
      {
           ...
          "system": {
            "filesystem": {
              "mount_point": "/boot",
              "device_name": "/dev/nvme0n1p1",
              "free": 582488064,
              "used": {
                "bytes": 155168768,
                "pct": 0.2269
              },
              "available": 528838656,
              "free_files": 46531,
              "type": "ext4",
              "files": 46848,
              "total": 737656832
            }
          }
        }
      },
      {
          ... 
          "system": {
            "filesystem": {
              "mount_point": "/",
              "files": 31145984,
              "free": 314722783232,
              "used": {
                "bytes": 186469289984,
                "pct": 0.392
              },
              "free_files": 29989368,
              "type": "ext4",
              "available": 289192267776,
              "device_name": "/dev/mapper/ubuntu--vg-root",
              "total": 501192073216
            }
          }
      },
      {
          "system": {
            "filesystem": {
              "mount_point": "/",
              "device_name": "/dev/mapper/ubuntu--vg-root",
              "files": 31145984,
              "used": {
                "bytes": 186469163008,
                "pct": 0.392
              },
              "free_files": 29989450,
              "available": 289192394752,
              "type": "ext4",
              "free": 314722910208,
              "total": 501192073216
            }
          }
      },
      {
          "system": {
            "filesystem": {
              "mount_point": "/boot",
              "files": 46848,
              "device_name": "/dev/nvme0n1p1",
              "used": {
                "pct": 0.2269,
                "bytes": 155168768
              },
              "available": 528838656,
              "type": "ext4",
              "free_files": 46531,
              "free": 582488064,
              "total": 737656832
            }
          }
      },
      {
          "system": {
            "filesystem": {
              "mount_point": "/boot",
              "free": 582488064,
              "device_name": "/dev/nvme0n1p1",
              "used": {
                "bytes": 155168768,
                "pct": 0.2269
              },
              "free_files": 46531,
              "type": "ext4",
              "available": 528838656,
              "files": 46848,
              "total": 737656832
            }
          }
      },
      {
          "system": {
            "filesystem": {
              "mount_point": "/",
              "device_name": "/dev/mapper/ubuntu--vg-root",
              "files": 31145984,
              "used": {
                "bytes": 186469019648,
                "pct": 0.392
              },
              "free": 314723053568,
              "type": "ext4",
              "available": 289192538112,
              "free_files": 29989396,
              "total": 501192073216
            }
          }
      }
    ]
  },
  "aggregations": {
    "aggs_by_hostname": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "hostname.com",
          "doc_count": 6,
          "aggs_by_mount_point": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
              {
                "key": "/",
                "doc_count": 3,
                "system.filesystem.used.pct_max": {
                  "value": 0
                }
              },
              {
                "key": "/boot",
                "doc_count": 3,
                "system.filesystem.used.pct_max": {
                  "value": 0
                }
              }
            ]
          }
        }
      ]
    }
  }
}

(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.