Define a Mapping for Percentage or Bytes (GB,MB) in Kibana

[shanky1997 (Shashank Tripathi)]

What I want is I have a data of disk usage I want alerting on it the data contain: disk_used: 10 GB like JSON I want to define a mapping in Kibana so that I can have an alerting condition for disk usage greater than 10 GB I tried to search the same problem but I did not find any useful solution until now, the same problem is with percentage i.e disk_utilization: 15%.

How to define a mapping for it I tried something like this:

{
  "index_patterns": "diskusage-*",
  "mappings": {
      "properties": {
        "created_at": {
          "type": "date",
          "format": "yyyy-MM-dd HH:mm:ss||yyyy-MM-dd||epoch_millis"
        },
        "disk_usage":{
          "type":"integer"
        },
        "Flowfile_usedSpace":{
           "type":"integer"
      }
  },
  "settings": {
    "number_of_shards": 2,
    "number_of_replicas": 1
  },
  "aliases": {
    "diskusage": {}
  }
}
}`

Help is Appreciated,
Thanks in Advance:.

[nickpeihl]

Metricbeat has examples of field types for file system data such as disk usage.

In short, I think you want to map these fields as "type": "float". The "Format" for how the field is formatted in Kibana can be changed in the Kibana index-pattern.

[shanky1997 (Shashank Tripathi)]

Thanks for the reply @nickpeihl but I do not find edit option once when an index is created can u be a little bit more specific.

{
  "index_patterns": "diskusage-*",
  "mappings": {
      "properties": {
        "created_at": {
          "type": "date",
          "format": "yyyy-MM-dd HH:mm:ss||yyyy-MM-dd||epoch_millis"
        },
        "disk_usage":{
          "type":"float"
        }
  },
  "settings": {
    "number_of_shards": 2,
    "number_of_replicas": 1
  },
  "aliases": {
    "diskusage": {}
  }
}
}

Will this work for me! or do I have to provide a format too.

I saw the advance index setting option:

[nickpeihl]

@shanky1997 You can not change the mappings of an index that is already created. You need to reindex your data into a new index. Reindex API is one way of doing it.

The Bytes format setting from your screenshot applies formatting to numerical field in your index patterns that have the "Bytes" format (third column).

If it's feasible for you, I strongly recommend checking out the features of Metricbeat as all of this configuration is built-in.

[shanky1997 (Shashank Tripathi)]

thanks @nickpeihl What if i want to define a mapping at time of creating index then what type of format is to be given?