Aggregations-Max

[prakash1243 (Mike)]

Hi-
I'd like to know if there is any aggregation to get the max 3 values; instead of 1 value.
For suppose if system.cpu.user attribute provides only maximum value (example: 95). If I wanted to check what's the maximum values below 95 ? How do I get it ?

"aggs": {
"1": {
"max": {
"field": "system.cpu.user.pct"
}
},

The above query gives only one maximum value. Would you please let me know how do I get maximum of 3 instances, so that I can get the delta time between the peaks ? Please let me know. Thanks !

[spinscale (Alexander Reelsen)]

Hey,

not sure I got your question right. Are you maybe searching for something like the percentile aggregation?

--Alex

[prakash1243 (Mike)]

Hi @spinscale

Thanks for your reply.

We are capturing the CPU user usage ( system.cpu.user) on a windows server using Metricbeats and visualizing the graphs on the dashboard.

We wanted to check the delta time between the peaks (suppose, If cpu% goes 85 and it drops to 75%) and what's the time difference between those peaks. Am trying to achieve this thru API query code level.

We are trying to get this using the Ruby Client.

Please let me know if you have any suggestion to get a solution for this.

Thanks in advance,
Prakash