Search Percentage >=

(Mike Harvey) #1

I have a metric coming from metricbeat which is system.memory.actual.used.pct which is formatted as a percentage. I simply want to filter for records over 90%. I have searcht the docs and see nothing about filtering % fields. What I am attemptiing to use in the search is:
system.memory.actual.used.pct: (>50 AND <=100)

Any idea of the correct search syntax for percentage fields? Thx,

(Tim Roes) #2

Hi Mike,

that corresponding field is a regular numeric field, holding decimal values for percentages. So a value of 50% would actually be 0.5 in that field.

You can filter for that as follows:

system.memory.actual.used.pct:(>0.5 AND <=1.0)


system.memory.actual.used.pct:{0.5 TO 1.0]

Since { and } are exclusive bounds, and [ and ] are inclusive bounds.

Also notice, that you should NOT have a space after your colon.

Hope that could help solving your issue?


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.