How to add multiple metricbeat parameter to query

[arvindK_sharma (Haritus)]

Hi,

I want to expose endpoint of Metricbeat system parameters (Same as KIBANA) with the help of NEST to create a page similar to KIBANA dashboard in my application. I want to fetch all the parameters like CPU, Memory, diskio etc. I write following query which gives me latest one hit for cpu parameter

get /metricbeat*/_search?pretty=true
{"size":1,
 "query":{"bool":{"must": [{"range": {"system.cpu.idle.pct": {"gte": 0}}}]}},
   "sort":[{"@timestamp": {"order": "desc"}}]}

I want to add memoery, diskio and some more parameter to it so I get on hit per parameter. I tried to add by this way but no luck

{"range": {"system.cpu.idle.pct": {"gte": 0}}}, {"range": {"system.memory.used.pct": {"gte": 0}}}

Please suggest how to implement it.

[ChrsMark (Chris Mark)]

Hi!

I would suggest to create the search you want in Kibana and then Inspect it in order to take the query and reuse it in your app.

[arvindK_sharma (Haritus)]

Will you please elaborate more on how to do that ?

[ChrsMark (Chris Mark)]

Hey,

have a look at https://www.elastic.co/guide/en/kibana/master/save-open-search.html.

After you have saved a search you can inspect this and see the source query. For instance:

[arvindK_sharma (Haritus)]

@ChrsMark

search you can inspect this and see the source query. For instance:

Thanks Chris,

Sorry for late reply, I was busy with other stuff for time being.

I found your suggestion very helpful and write my query with multiple fields now.
Eventually , I found that query gives me result if I club same metricset name fields like memory or CPU. like:
{"range": {
"system.cpu.iowait.pct": {
"gte": 0,
"lt": 1
} }},
{"range": {
"system.cpu.idle.pct": {
"gte": 0,
"lt": 1 }}},

But if I add different metricset name than it wont give anything
{ "range": {
"system.memory.actual.used.pct": {
"gte": 0,
"lt": 1
}}},
{"range": {
"system.cpu.idle.pct": {
"gte": 0,
"lt": 1}}}

Here I add 'Memory' type with 'CPU' so query result is empty

My objective is to get all system parameters of metricset.name.

[arvindK_sharma (Haritus)]

Actully I want to return % in below screen should return by my endpoints.

[ChrsMark (Chris Mark)]

Hi!

Glad that you found inspecting useful!

For your question now I would suggest something like this:

However since your question tends to be more Elasticsearch oriented, you could also ask in Elasticsearch's forum so as to get the most optimised query for your purposes.

Thanks!