Count field matches

Elastic Stack Logstash
1

Is there a way to count field occurences on an entry?
I have this data:

      "cpus" => {
    "cpu0" => {
            "user" => 448515294,
          "user_p" => 0.3256,
            "nice" => 4644,
          "system" => 343251086,
        "system_p" => 0.2859,
            "idle" => 3324754264,
          "iowait" => 1326397,
             "irq" => 975,
         "softirq" => 657110,
           "steal" => 21766840
    },
    "cpu1" => {
            "user" => 492064907,
          "user_p" => 0.3266,
            "nice" => 3095,
          "system" => 380342848,
        "system_p" => 0.286,
            "idle" => 3196040078,
          "iowait" => 778998,
             "irq" => 212361,
         "softirq" => 20395641,
           "steal" => 22651504
    },
    "cpu2" => {
            "user" => 405626520,
          "user_p" => 0.2368,
            "nice" => 1997,
          "system" => 261763596,
        "system_p" => 0.1536,
            "idle" => 3039135978,
          "iowait" => 394322,
             "irq" => 302322,
         "softirq" => 417117840,
           "steal" => 19745895
    },
    "cpu3" => {
            "user" => 425121352,
          "user_p" => 0.3519,
            "nice" => 3012,
          "system" => 320322316,
        "system_p" => 0.2841,
            "idle" => 3405591011,
          "iowait" => 699824,
             "irq" => 49,
         "softirq" => 68332,
           "steal" => 18688737
    },
    "cpu4" => {
            "user" => 387204956,
          "user_p" => 0.3391,
            "nice" => 2533,
          "system" => 303255772,
        "system_p" => 0.29,
            "idle" => 3468212764,
          "iowait" => 296950,
             "irq" => 232,
         "softirq" => 80455,
           "steal" => 17710338
    },
    "cpu5" => {
            "user" => 362084413,
          "user_p" => 0.3364,
            "nice" => 1776,
          "system" => 276928325,
        "system_p" => 0.2776,
            "idle" => 3506362315,
          "iowait" => 293728,
             "irq" => 54481,
         "softirq" => 11395774,
           "steal" => 16864801
    },
    "cpu6" => {
            "user" => 341761869,
          "user_p" => 0.3347,
            "nice" => 2119,
          "system" => 280176674,
        "system_p" => 0.2911,
            "idle" => 3552852535,
          "iowait" => 278686,
             "irq" => 30,
         "softirq" => 51706,
           "steal" => 15925629
    },
    "cpu7" => {
            "user" => 517516225,
          "user_p" => 0.3324,
            "nice" => 1871,
          "system" => 363758653,
        "system_p" => 0.2828,
            "idle" => 2607610042,
          "iowait" => 259868,
             "irq" => 863261,
         "softirq" => 473192672,
           "steal" => 22282389
    }

I'd like to count the number of cpus.cpu* occurences to know how many cores does the server have but I can't find how to do it.
I've tried using this:

metrics {
            meter => [ "[cpus][cpu*]" ]
        }

but it counts on a timeset instead of per-entry

2

I think you need to use a ruby filter that does event['cpu_count'] = event['cpus'].keys.length or similar.

1 Like
3

Worked perfectly! Never occured to me to use a ruby filter. Thank you

Would there be a way on Kibana/Grafana to graph nested field with wildcards? Such as MAX of cpus.cpu*

4

Would there be a way on Kibana/Grafana to graph nested field with wildcards? Such as MAX of cpus.cpu*

I don't think so but I'm no Kibana expert.