ECE Monitoring - cgroup memory fields mapped as keyword instead of numeric

Elastic Observability Metrics
1

Hello,

I'm investigating CPU throttling and resource entitlement for Elasticsearch nodes running on Elastic Cloud Enterprise (ECE).

While building dashboards from the `.monitoring-es-*` indices, I noticed the following fields are mapped as `keyword`:

  • `elasticsearch.node.stats.os.cgroup.memory.limit.bytes`
  • `elasticsearch.node.stats.os.cgroup.memory.usage.bytes`

Example field caps output:

"elasticsearch.node.stats.os.cgroup.memory.limit.bytes": {
  "keyword": {
    "type": "keyword"
  }
},
"elasticsearch.node.stats.os.cgroup.memory.usage.bytes": {
  "keyword": {
    "type": "keyword"
  }
}

The values themselves appear to be numeric byte counts (e.g. 34359738368 for 32 GB), but because they are mapped as keywords they cannot be used directly in Lens metrics, formulas, or byte formatting without runtime fields.

Is this expected behaviour for ECE/Metricbeat monitoring data, or is this a mapping issue?

Environment:

  • Elastic Cloud Enterprise (ECE) 4.0.3
  • Elasticsearch 9.4.2
  • Data source: .monitoring-es-mb-*

Best regards,

Willem