DSL Query For CPU Load (MetricBeat Data)

Elastic Stack Elasticsearch
1

Hi-
Am trying to create a DSL query to fetch the CPU load of a server from my Elastic search engine.
Could someone please help me in creating a query for this.

PS: I will execute this query using the Elasticsearch gem in the API level (with out logging to the Kibana).

Thanks in advance for your help.

Regards,
Prakash

2

What do you have so far?

3

Thanks for your reply, @warkolm.

This is what I could write it so far:

GET metricbeat-2017.01.09/metricsets/_search?q=cpu
{
"size":1
}

This is the response, I've got:

{
"took": 1,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"failed": 0
},
"hits": {
"total": 184,
"max_score": 5.304149,
"hits": [
{
"_index": "metricbeat-2017.01.09",
"_type": "metricsets",
"_id": "AVmBoCrbVRlweE2aySFN",
"_score": 5.304149,
"_source": {
"@timestamp": "2017-01-09T05:07:54.525Z",
"beat": {
"hostname": "AAEINBLR03199L",
"name": "AAEINBLR03199L",
"version": "5.1.1"
},
"metricset": {
"module": "system",
"name": "cpu",
"rtt": 0
},
"system": {
"cpu": {
"idle": {
"pct": 0.9062
},
"iowait": {
"pct": 0
},
"irq": {
"pct": 0
},
"nice": {
"pct": 0
},
"softirq": {
"pct": 0
},
"steal": {
"pct": 0
},
"system": {
"pct": 0.0362
},
"user": {
"pct": 0.0576
}
}
},
"type": "metricsets"
}
}
]
}
}

I just have a couple of questions:

-> Is my query got the latest record from Elastic Search engine?
-> How do I navigate it to the lower nodes like the highlighted above in the query itself.

Please correct me, if am wrong anywhere.

Thanks !

4

Hi @warkolm-
Could you please help me out here. Thanks!

5

I don't know, you'd have to query and compare? It might be easiest to just take something from the last 5 seconds and live with the delay.

Navigate? In the response?

6

Yes @warkolm , Navigate in the Response.

Could you please let me know, how do I execute this query in the Ruby Client.

GET metricbeat-2017.01.09/metricsets/_search?q=cpu
{
"size":1
}

7

I don't know what that means.

8

Hi @warkolm:

I have this query :

GET /_search
{
"query": {
"dis_max": {
"queries": [
{ "match": { "index": "metricbeat-2017.01.18" }},
{ "match": { "type": "metricsets" }},
{ "match": { "beat.hostname": "HPPP-140-01" }}
]
}

}
}

When I execute this, I get the below output:

{
"_index": "metricbeat-2017.01.16",
"_type": "metricsets",
"_id": "AVmkYc7mU2H8SwTt6SMr",
"_score": 0.000011355958,
"_source": {
"@timestamp": "2017-01-16T00:00:06.089Z",
"beat": {
"hostname": "HPPP-140-01",
"name": "HPPP-140-01",
"version": "5.1.1"
},
"metricset": {
"module": "system",
"name": "cpu",
"rtt": 0
},
"system": {
"cpu": {
"idle": {
"pct": 0.9547
},
"iowait": {
"pct": 0
},
"irq": {
"pct": 0
},
"nice": {
"pct": 0
},
"softirq": {
"pct": 0
},
"steal": {
"pct": 0
},
"system": {
"pct": 0.0101
},
"user": {
"pct": 0.0352
}
}
},

I'd like to how how do I get the system.cpu.idle.pct value from the above output. Please let me know if am unclear.

And how do I get the content in a field at the DSL level. Please let me know. Thanks !

9

Hi @warkolm:

Could you please let me know, if am still unclear. Thanks !

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.