# Need help with Visualisation - highest percentage of PQ current size FOR THE LAST 60 mins

**URL:** <https://discuss.elastic.co/t/need-help-with-visualisation-highest-percentage-of-pq-current-size-for-the-last-60-mins/385462>\
**Category:** Kibana\
**Created:** [March 16, 2026, 10:33am UTC](https://discuss.elastic.co/t/need-help-with-visualisation-highest-percentage-of-pq-current-size-for-the-last-60-mins/385462 "2026-03-16T10:33:51Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![Whoami1980](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/whoami1980/32/147545_2.png) [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\
**Post date:** [March 16, 2026, 10:33am UTC](https://discuss.elastic.co/t/need-help-with-visualisation-highest-percentage-of-pq-current-size-for-the-last-60-mins/385462/1 "2026-03-16T10:33:51Z")

</div>

We need help in the following. This is what we have configure below.

However how can we see the top 10 records in a table  
ORDER BY highest percentage of PQ current size FOR THE LAST 60 mins

Data View Records

host.hostname  
logstash.pipeline.name

logstash.pipeline.info.batch.size  
logstash.pipeline.info.workers

logstash.pipeline.total.flow.queue\_backpressure.last\_1\_minute  
logstash.pipeline.total.flow.worker\_utilization.current  
logstash.pipeline.total.queues\_size.bytes

Visualization configuration

Table Logstash Stack Monitoring Metrics

Metrics

Worker Count  
Batch Size  
Worker Utilization (Max %)  
PQ Size (Max)  
Backpressure (Max)

OR is there a better way or query to go about doing this?

Kindly advice. Thanks in advance

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [March 17, 2026, 12:09pm UTC](https://discuss.elastic.co/t/need-help-with-visualisation-highest-percentage-of-pq-current-size-for-the-last-60-mins/385462/2 "2026-03-17T12:09:15Z")

</div>

Hello @Whoami1980

We will need to know more about data & ELK version.

I believe we can even use ES|QL like below if it works for you :

> **Data Used :**
>
> POST test-logstash-metrics/\_bulk  
> { "index": {} }{ "@timestamptimestamp": "2026-03-17T10:00:00Z", "host": { "hostname": "host1" }, "logstash": { "pipeline": { "name": "pipeA", "total": { "queues\_size": { "bytes": 200000000 }, "flow": { "worker\_utilization": { "current": 0.65 }, "queue\_backpressure": { "last\_1\_minute": 0.10 } } }, "info": { "workers": 2, "batch": { "size": 125 } } } } }{ "index"@timestamp {} }{ "@timestamp": "2026-03-17T10:05:00Z", "host": { "hostname": "host1" }, "logstash": { "pipeline": { "name": "pipeA", "total": { "queues\_size": { "bytes": 400000000 }, "flow": { "worker\_utilization": { "current": 0.75 }, "queue\_backpressure": { "last\_1\_minute": 0.20 } } }, "info": { "workers": 2, "batch": { "size": 125 } } } } }@timestamp "index": {} }{ "@timestamp": "2026-03-17T10:10:00Z", "host": { "hostname": "host2" }, "logstash": { "pipeline": { "name": "pipeB", "total": { "queues\_size": { "bytes": 800000000 }, "flow": { "worker\_utilization": { "current": 0.85 }, "queue\_backpressure": { "last\_1\_minute": 0.30 } } }, "info": { "workers": 4, "batch": { "size": 200 @timestamp } } } }{ "index": {} }{ "@timestamp": "2026-03-17T10:15:00Z", "host": { "hostname": "host2" }, "logstash": { "pipeline": { "name": "pipeB", "total": { "queues\_size": { "bytes": 900000000 }, "flow": { "worker\_utilization": { "current": 0.90 }, "queue\_backpressure": { "last\_1\_minute": 0.35 } } }, "info": { "workers": 4, "batch": { "si@timestampe": 200 } } } } }{ "index": {} }{ "@timestamp": "2026-03-17T10:20:00Z", "host": { "hostname": "host3" }, "logstash": { "pipeline": { "name": "pipeC", "total": { "queues\_size": { "bytes": 100000000 }, "flow": { "worker\_utilization": { "current": 0.40 }, "queue\_backpressure": { "last\_1\_minute": 0.05 } } }, "info": { "workers": 1, "bat@timestamph": { "size": 50 } } } } }{ "index": {} }{ "@timestamp": "2026-03-17T10:25:00Z", "host": { "hostname": "host3" }, "logstash": { "pipeline": { "name": "pipeC", "total": { "queues\_size": { "bytes": 150000000 }, "flow": { "worker\_utilization": { "current": 0.50 }, "queue\_backpressure": { "last\_1\_minute": 0.08 } } }, "info": { "workers"@timestamp 1, "batch": { "size": 50 } } } } }{ "index": {} }{ "@timestamp": "2026-03-17T10:30:00Z", "host": { "hostname": "host4" }, "logstash": { "pipeline": { "name": "pipeD", "total": { "queues\_size": { "bytes": 700000000 }, "flow": { "worker\_utilization": { "current": 0.70 }, "queue\_backpressure": { "last\_1\_minute": 0.25 } } }, "info": { "@timestamporkers": 3, "batch": { "size": 150 } } } } }{ "index": {} }{ "@timestamp": "2026-03-17T10:35:00Z", "host": { "hostname": "host4" }, "logstash": { "pipeline": { "name": "pipeD", "total": { "queues\_size": { "bytes": 950000000 }, "flow": { "worker\_utilization": { "current": 0.95 }, "queue\_backpressure": { "last\_1\_minute": 0.40 } } }, "i@timestampfo": { "workers": 3, "batch": { "size": 150 } } } } }{ "index": {} }{ "@timestamp": "2026-03-17T10:40:00Z", "host": { "hostname": "host5" }, "logstash": { "pipeline": { "name": "pipeE", "total": { "queues\_size": { "bytes": 300000000 }, "flow": { "worker\_utilization": { "current": 0.60 }, "queue\_backpressure": { "last\_1\_minute": 0.15 @timestamp } }, "info": { "workers": 2, "batch": { "size": 100 } } } } }{ "index": {} }{ "@timestamp": "2026-03-17T10:45:00Z", "host": { "hostname": "host5" }, "logstash": { "pipeline": { "name": "pipeE", "total": { "queues\_size": { "bytes": 500000000 }, "flow": { "worker\_utilization": { "current": 0.65 }, "queue\_backpressure": { "last\_1\_minut@timestamp": 0.18 } } }, "info": { "workers": 2, "batch": { "size": 100 } } } } }{ "index": {} }{ "@timestamp": "2026-03-17T10:50:00Z", "host": { "hostname": "host1" }, "logstash": { "pipeline": { "name": "pipeF", "total": { "queues\_size": { "bytes": 850000000 }, "flow": { "worker\_utilization": { "current": 0.88 }, "queue\_backpressure": { "las@timestamp\_1\_minute": 0.33 } } }, "info": { "workers": 5, "batch": { "size": 250 } } } } }{ "index": {} }{ "@timestamp": "2026-03-17T10:52:00Z", "host": { "hostname": "host2" }, "logstash": { "pipeline": { "name": "pipeG", "total": { "queues\_size": { "bytes": 600000000 }, "flow": { "worker\_utilization": { "current": 0.77 }, "queue\_backpressure@timestamp: { "last\_1\_minute": 0.22 } } }, "info": { "workers": 3, "batch": { "size": 180 } } } } }{ "index": {} }{ "@timestamp": "2026-03-17T10:54:00Z", "host": { "hostname": "host3" }, "logstash": { "pipeline": { "name": "pipeH", "total": { "queues\_size": { "bytes": 920000000 }, "flow": { "worker\_utilization": { "current": 0.93 }, "queue\_bac@timestamppressure": { "last\_1\_minute": 0.37 } } }, "info": { "workers": 6, "batch": { "size": 300 } } } } }{ "index": {} }{ "@timestamp": "2026-03-17T10:55:00Z", "host": { "hostname": "host4" }, "logstash": { "pipeline": { "name": "pipeI", "total": { "queues\_size": { "bytes": 250000000 }, "flow": { "worker\_utilization": { "current": 0.55 }, @timestampqueue\_backpressure": { "last\_1\_minute": 0.12 } } }, "info": { "workers": 2, "batch": { "size": 90 } } } } }{ "index": {} }{ "@timestamp": "2026-03-17T10:56:00Z", "host": { "hostname": "host5" }, "logstash": { "pipeline": { "name": "pipeJ", "total": { "queues\_size": { "bytes": 780000000 }, "flow": { "worker\_utilization": { "current": @timestamp.82 }, "queue\_backpressure": { "last\_1\_minute": 0.28 } } }, "info": { "workers": 4, "batch": { "size": 210 } } } } }{ "index": {} }{ "@timestamp": "2026-03-17T10:57:00Z", "host": { "hostname": "host1" }, "logstash": { "pipeline": { "name": "pipeK", "total": { "queues\_size": { "bytes": 990000000 }, "flow": { "worker\_utilization": { "c@timestamprrent": 0.97 }, "queue\_backpressure": { "last\_1\_minute": 0.45 } } }, "info": { "workers": 8, "batch": { "size": 500 } } } } }{ "index": {} }{ "@timestamp": "2026-03-17T10:58:00Z", "host": { "hostname": "host2" }, "logstash": { "pipeline": { "name": "pipeL", "total": { "queues\_size": { "bytes": 120000000 }, "flow": { "worker\_utilization": { "current": 0.35 }, "queue\_backpressure": { "last\_1\_minute": 0.05 } } }, "info": { "workers": 1, "batch": { "size": 60 } } } } }{ "index": {} }{ "@timestamp": "2026-03-17T10:59:00Z", "host": { "hostname": "host3" }, "logstash": { "pipeline": { "name": "pipeM", "total": { "queues\_size": { "bytes": 660000000 }, "flow": { "worker\_utilization": { "current": 0.78 }, "queue\_backpressure": { "last\_1\_minute": 0.26 } } }, "info": { "workers": 3, "batch": { "size": 175 } } } } }

Query used :

```auto
FROM test-logstash-metrics
| WHERE @timestamp > NOW() - 60 minutes
| STATS 
    max_pq_bytes = MAX(logstash.pipeline.total.queues_size.bytes),
    max_utilization = MAX(logstash.pipeline.total.flow.worker_utilization.current),
    max_backpressure = MAX(logstash.pipeline.total.flow.queue_backpressure.last_1_minute),
    max_workers = MAX(logstash.pipeline.info.workers),
    max_batch = MAX(logstash.pipeline.info.batch.size)
  BY host.hostname, logstash.pipeline.name
| EVAL pq_percent = (max_pq_bytes / 1073741824.0) * 100
| SORT pq_percent DESC
| LIMIT 10

```

Result :

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/6/f65e76f2ef5b74d63483878562b99c29b31fcb65.png)

Thanks!!

---

<div class="post-metadata">

**Author:** ![Whoami1980](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/whoami1980/32/147545_2.png) [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\
**Post date:** [March 18, 2026, 4:14am UTC](https://discuss.elastic.co/t/need-help-with-visualisation-highest-percentage-of-pq-current-size-for-the-last-60-mins/385462/3 "2026-03-18T04:14:48Z")

</div>

@Tortoise Thanks for the assistance. Our elastisearch version is 8.19.10

In regards to the query need some basic guidance here.

Visualization configuration shows Table - Logstash Stack Monitoring Metrics

"FROM Logstash.Stack.Monitoring.Metrics" gives me Unknown index [Logstash.Stack.Monitoring.Metrics]

I went to the cluster to look for the indices but to no avail. KIndly advice

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [March 18, 2026, 7:06am UTC](https://discuss.elastic.co/t/need-help-with-visualisation-highest-percentage-of-pq-current-size-for-the-last-60-mins/385462/4 "2026-03-18T07:06:33Z")

</div>

Hello @Whoami1980

The table visualization must be created from a dataview. We will have to find that dataview than from discover we find that dataview , manage this dataview this will show the index pattern from which this dataview is created. We will have to use this index pattern in the query for ES|QL.

Thanks!!

---

<div class="post-metadata">

**Author:** ![Whoami1980](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/whoami1980/32/147545_2.png) [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\
**Post date:** [March 18, 2026, 7:39am UTC](https://discuss.elastic.co/t/need-help-with-visualisation-highest-percentage-of-pq-current-size-for-the-last-60-mins/385462/5 "2026-03-18T07:39:02Z")

</div>

@Tortoise

i have verified.  
Data view = "Logstash Stack Monitoring Metrics"

```auto
POST /_query?format=txt
{
  "query": """
  FROM Logstash Stack Monitoring Metrics
| WHERE @timestamp > NOW() - 60 minutes
| STATS 
      max_pq_bytes = MAX(logstash.pipeline.total.queues_size.bytes),
      max_utilization = MAX(logstash.pipeline.total.flow.worker_utilization.current),
      max_backpressure = MAX(logstash.pipeline.total.flow.queue_backpressure.last_1_minute),
      max_workers = MAX(logstash.pipeline.info.workers),
      max_batch = MAX(logstash.pipeline.info.batch.size)
    BY host.hostname, logstash.pipeline.name
| EVAL pq_percent = (max_pq_bytes / 1073741824.0) * 100
| SORT pq_percent DESC
| LIMIT 10
  """
}

```

```auto
{
  "error": {
    "root_cause": [
      {
        "type": "parsing_exception",
        "reason": "line 2:17: mismatched input 'Stack' expecting {<EOF>, '|', ',', '[', 'metadata'}"
      }
    ],
    "type": "parsing_exception",
    "reason": "line 2:17: mismatched input 'Stack' expecting {<EOF>, '|', ',', '[', 'metadata'}",
    "caused_by": {
      "type": "input_mismatch_exception",
      "reason": null
    }
  },
  "status": 400
}

```

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [March 18, 2026, 7:49am UTC](https://discuss.elastic.co/t/need-help-with-visualisation-highest-percentage-of-pq-current-size-for-the-last-60-mins/385462/6 "2026-03-18T07:49:43Z")

</div>

Hello @Whoami1980

Just to be sure as have never seen the index name with such pattern :

Click on Manage this data view

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/9/39d44c54f83eaf27a938fb3fa741491cddb82f54.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/2/424be12db1258bd523a3b4053ec6ef91bd708afe.png)

So from above the index pattern is kibana\_sample\_data\_ecommerce

Error similar to you :

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/0/70643f13f5b9e471e026cc5efd684145db40bb99.png)

If we use correct index pattern :

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/7/9779e6abc19daff99332e42b057f330b486756f4.png)

Thanks!!

---

<div class="post-metadata">

**Author:** ![Whoami1980](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/whoami1980/32/147545_2.png) [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\
**Post date:** [March 18, 2026, 8:40am UTC](https://discuss.elastic.co/t/need-help-with-visualisation-highest-percentage-of-pq-current-size-for-the-last-60-mins/385462/7 "2026-03-18T08:40:38Z")

</div>

The data view name is correct. with your steps i have found the index pattern. The query have run successfully. However looking through the results. some pq\_percent values contains null or have abnormal percentage like 1999%

```auto
max_pq_bytes |max_utilization|max_backpressure| max_workers | max_batch | host.hostname | logstash.pipeline.name | pq_percent    
---------------+---------------+----------------+---------------+---------------+---------------+------------------------------+------------------
21414586420 |99.01 |0.514 |16 |1000 |ABCDEFGHIJKLM05|network-netflow-agent |1994.3887759000063
9473071805 |98.98 |0.371 |16 |1000 |ABCDEFGHIJKLM04|network-netflow-agent |882.2485622949898 
null |null |null |2 |125 |ABCDEFGHIJKLM07|storage_dell_isilon |null              
null |null |null |2 |125 |ABCDEFGHIJKLM07|storage_cisco_ndfc |null  

```

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [March 18, 2026, 1:02pm UTC](https://discuss.elastic.co/t/need-help-with-visualisation-highest-percentage-of-pq-current-size-for-the-last-60-mins/385462/8 "2026-03-18T13:02:42Z")

</div>

Hello @Whoami1980

I am not sure if you are using the same query because as per the data in your environment you will have to review and change the query. I had attached the reference data I used to create the query if your data matches as it is than no issues else need to re-work on the query.

Thanks!!

---

<div class="post-metadata">

**Author:** ![Whoami1980](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/whoami1980/32/147545_2.png) [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\
**Post date:** [March 19, 2026, 2:38am UTC](https://discuss.elastic.co/t/need-help-with-visualisation-highest-percentage-of-pq-current-size-for-the-last-60-mins/385462/9 "2026-03-19T02:38:14Z")

</div>

@Tortoise

This is the query that we use. no change

```auto
POST /_query?format=txt
{
  "query": """
  FROM ABCD*:metrics-logstash*
| WHERE @timestamp > NOW() - 60 minutes
| STATS 
      max_pq_bytes = MAX(logstash.pipeline.total.queues.current_size.bytes),
      max_utilization = MAX(logstash.pipeline.total.flow.worker_utilization.current),
      max_backpressure = MAX(logstash.pipeline.total.flow.queue_backpressure.last_1_minute),
      max_workers = MAX(logstash.pipeline.info.workers),
      max_batch = MAX(logstash.pipeline.info.batch_size)
    BY host.hostname, logstash.pipeline.name
| EVAL pq_percent = (max_pq_bytes / 1073741824.0) * 100
| SORT pq_percent DESC
| LIMIT 100
  """
}

```

The results as per last reply but why are we getting abnormal or null pq\_percent

---

<div class="post-metadata">

**Author:** ![Whoami1980](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/whoami1980/32/147545_2.png) [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\
**Post date:** [March 19, 2026, 4:28am UTC](https://discuss.elastic.co/t/need-help-with-visualisation-highest-percentage-of-pq-current-size-for-the-last-60-mins/385462/10 "2026-03-19T04:28:19Z")

</div>

@Tortoise

I think the results are ok or axcurate. just not sure how we can deal with the high pq\_percent . i am assuming here we are ingesting too much data espeically netflow or maybe i am wrong

```auto
 max_pq_bytes |max_utilization|max_backpressure| max_workers | max_batch | host.hostname | logstash.pipeline.name | pq_percent    
---------------+---------------+----------------+---------------+---------------+---------------+-----------------------------+------------------
null |0.0 |0.0 |1 |400 | |generic-snmp-trap-new |null              
null |0.0 |0.0 |1 |400 | |generic-snmp-trap-new |null              
null |0.0 |0.0 |1 |400 | |generic-snmp-trap-new |null              
null |0.0 |0.0 |1 |400 | |generic-snmp-trap-new |null              
null |null |null |null |null |null |null |null              
null |0.0 |0.0 |1 |400 | |generic-snmp-trap-new |null              
null |0.0 |0.0 |1 |400 | |generic-snmp-trap-new |null              
null |0.0 |0.0 |1 |400 | |generic-snmp-trap-new |null              
null |0.0 |0.0 |2 |125 | |server_ntp |null              
null |null |null |null |null | |snmp-poll-ise-cisco |null              
null |0.0 |0.0 |1 |400 | |generic-snmp-trap-new |null              
109398511173 |99.02 |0.478 |16 |1000 | |network-netflow-agent |10188.530308473855
96894371358 |99.06 |0.54 |16 |1000 | |network-netflow-agent |9023.991539888084 
67746499558 |99.18 |0.0 |16 |1000 | |network-netflow-agent |6309.384438954294 
63881529337 |98.81 |0.468 |16 |1000 | |network-netflow-agent |5949.431037250906 
55889090828 |98.75 |0.627 |16 |1000 | |network-netflow-agent |5205.077196285129 
39436432256 |98.72 |0.502 |16 |1000 | |network-netflow-agent |3672.8039622306824
33366684074 |98.81 |0.649 |16 |1000 | |network-netflow-agent |3107.5146118178964
22296851339 |98.96 |0.548 |16 |1000 | |network-netflow-agent |2076.556099485606 
21476246016 |99.67 |0.296 |8 |1000 | |network-cisco-ftd |2000.1312732696533
11105622619 |95.62 |9.529 |16 |1000 | |system |1034.2917050234973
11025044615 |99.74 |0.093 |8 |1000 | |network-cisco-ftd |1026.7872936092317
8222511646 |98.93 |12.53 |16 |1000 | |system_windows |765.7810715958476 
7180350372 |99.47 |0.682 |16 |1000 | |network-fortigate |668.7222395092249 
6600029351 |99.28 |3.071 |16 |1000 | |system_windows |614.6756327711046 
6413602329 |99.23 |4.938 |16 |1000 | |system_windows |597.3132633604109 
5991907597 |98.89 |5.441 |16 |1000 | |system_windows |558.0398810096085 
5953351446 |99.67 |0.064 |8 |1000 | |network-cisco-ftd |554.4490596279502 
5913354891 |99.64 |0.262 |2 |500 | |network-infoblox |550.7240901701152 
4772000000 |99.48 |3.558 |16 |1000 | |system_windows |444.42713260650635
4700235372 |99.02 |2.7 |16 |1000 | |system_windows |437.74353079497814
3663256673 |99.05 |1.474 |16 |1000 | |system_windows |341.1673636175692 
3382254554 |98.64 |7.915 |16 |1000 | |system_windows |314.9970019236207 
3334399747 |98.9 |4.172 |16 |1000 | |system_windows |310.540175717324  
2665625266 |98.5 |8.506 |16 |1000 | |system_windows |248.25569856911898
2352279641 |98.73 |0.933 |16 |1000 | |system_windows |219.07311314716935
2285006777 |99.58 |0.51 |16 |1000 | |system_windows |212.80783945694566
2031468499 |99.37 |0.656 |16 |1000 | |system_windows |189.19524727389216
1638290506 |99.3 |0.888 |16 |1000 | |system_windows |152.5776932016015 
1539422861 |99.28 |1.233 |16 |1000 | |system_windows |143.3699262328446 
1258663732 |99.68 |0.107 |1 |400 | |generic-snmp-trap |117.22219474613667

```

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [March 19, 2026, 6:02am UTC](https://discuss.elastic.co/t/need-help-with-visualisation-highest-percentage-of-pq-current-size-for-the-last-60-mins/385462/11 "2026-03-19T06:02:48Z")

</div>

Hello @Whoami1980

Please check the denominator which is set to 1 GB :

EVAL pq\_percent = (max\_pq\_bytes / 1073741824.0) \* 100

you need to find the denominator value in your environment & add it go get correct pq\_percent.

Or one way is check the original table you have in your environment and see how pq\_percent was calculated to find the denominator field.

Thanks!!

---

<div class="post-metadata">

**Author:** ![Whoami1980](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/whoami1980/32/147545_2.png) [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\
**Post date:** [March 19, 2026, 7:09am UTC](https://discuss.elastic.co/t/need-help-with-visualisation-highest-percentage-of-pq-current-size-for-the-last-60-mins/385462/13 "2026-03-19T07:09:15Z")

</div>

@Tortoise

I figure out that the denominator should be  
"logstash.pipeline.total.queues.max\_size.bytes"

The issue i am facing now is below divide return me with 0 ☹  
EVAL pq\_percent = (max\_pq\_bytes / max\_queues\_size) \* 100

```auto
POST /_query?format=txt
{
  "query": """
  FROM ABCD*:metrics-logstash*
| WHERE @timestamp > NOW() - 60 minutes
    AND (logstash.pipeline.total.queues.current_size.bytes) IS NOT NULL
    AND (logstash.pipeline.total.queues.max_size.bytes) > 0
| STATS 
      max_pq_bytes = MAX(logstash.pipeline.total.queues.current_size.bytes),
      max_workers = MAX(logstash.pipeline.info.workers),
      max_batch = MAX(logstash.pipeline.info.batch_size),
      max_queues_size = MAX(logstash.pipeline.total.queues.max_size.bytes)
    BY host.hostname, logstash.pipeline.name
|   
    EVAL pq_percent = (max_pq_bytes / max_queues_size) * 100
| SORT pq_percent DESC
| LIMIT 100
    """
}

```

```auto
max_pq_bytes | max_workers | max_batch |max_queues_size| host.hostname | logstash.pipeline.name | pq_percent   
---------------+---------------+---------------+---------------+---------------+----------------------------------------------------------------+-----------
78446433 |2 |500 |32212254720 | |network-cisco-san |0              
375256021 |8 |500 |32212254720 | |snmp-poll-fw-fortigate |0              
1 |2 |500 |32212254720 | |network-cisco-aci |0 

```

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [March 19, 2026, 7:21am UTC](https://discuss.elastic.co/t/need-help-with-visualisation-highest-percentage-of-pq-current-size-for-the-last-60-mins/385462/14 "2026-03-19T07:21:39Z")

</div>

Hello @Whoami1980

you can try :

`EVAL pq_percent = ROUND((TO_DOUBLE(max_pq_bytes) / max_queues_size) * 100, 2)`

Thanks!!

---

<div class="post-metadata">

**Author:** ![Whoami1980](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/whoami1980/32/147545_2.png) [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\
**Post date:** [March 19, 2026, 7:43am UTC](https://discuss.elastic.co/t/need-help-with-visualisation-highest-percentage-of-pq-current-size-for-the-last-60-mins/385462/15 "2026-03-19T07:43:15Z")

</div>

nice. that works though i still dont understand the magic.  
but will remember this by hard memory for now.

btw i assume we can use this esql query to create an alert?  
instead of manually running this on devtools

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [March 19, 2026, 8:02am UTC](https://discuss.elastic.co/t/need-help-with-visualisation-highest-percentage-of-pq-current-size-for-the-last-60-mins/385462/16 "2026-03-19T08:02:57Z")

</div>

Hello ,

it depends on the requirement but yes there is an option :

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/2/c2fcc8c8d5166134ab369d0b1e8102df9ea99ad0.png)

Thanks!!

---

<div class="post-metadata">

**Author:** ![Whoami1980](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/whoami1980/32/147545_2.png) [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\
**Post date:** [March 19, 2026, 9:10am UTC](https://discuss.elastic.co/t/need-help-with-visualisation-highest-percentage-of-pq-current-size-for-the-last-60-mins/385462/17 "2026-03-19T09:10:15Z")

</div>

@Tortoise Thanks for the assistance. Very much appreciated