Search Percentage >=

[mike.harvey]

I have a metric coming from metricbeat which is system.memory.actual.used.pct which is formatted as a percentage. I simply want to filter for records over 90%. I have searcht the docs and see nothing about filtering % fields. What I am attemptiing to use in the search is:
system.memory.actual.used.pct: (>50 AND <=100)

Any idea of the correct search syntax for percentage fields? Thx,

[timroes]

Hi Mike,

that corresponding field is a regular numeric field, holding decimal values for percentages. So a value of 50% would actually be 0.5 in that field.

You can filter for that as follows:

system.memory.actual.used.pct:(>0.5 AND <=1.0)

or

system.memory.actual.used.pct:{0.5 TO 1.0]

Since { and } are exclusive bounds, and [ and ] are inclusive bounds.

Also notice, that you should NOT have a space after your colon.

Hope that could help solving your issue?

Cheers,
Tim