Hi Chris @pickypg
I had deleted the index with the above data, but scheduled the beats again and captured the output and document as well, Here are the details:
Max and Average values:
"aggregations": {
"average_cpu": {
"value": 0.00013767176562094898
},
"max_cpu": {
"value": 0.094
}
}
And I ran your above query with 0.094 as the filter and here is the document received:
{
"took": 1,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"failed": 0
},
"hits": {
"total": 3,
"max_score": 0,
"hits": [
{
"_index": "metricbeat-6.0.0-alpha1-2017.04.20",
"_type": "doc",
"_id": "AVuKJ0tAdFW3h5XRRlha",
"_score": 0,
"_source": {
"@timestamp": "2017-04-20T07:52:00.923Z",
"beat": {
"hostname": "HPPP-01-DL20-Secondary",
"name": "HPPP-01-DL20-Secondary",
"version": "6.0.0-alpha1"
},
"metricset": {
"module": "system",
"name": "process",
"rtt": 3999
},
"system": {
"process": {
"cmdline": "\"C:\\Program Files\\metricbeat\\\\metricbeat.exe\" -c \"C:\\Program Files\\metricbeat\\\\metricbeat.yml\" -path.home \"C:\\Program Files\\metricbeat\" -path.data \"C:\\\\ProgramData\\\\metricbeat\"",
"cpu": {
"start_time": "2017-04-20T06:52:38.615Z",
"total": {
"pct": 0.0943
}
},
"memory": {
"rss": {
"bytes": 23928832,
"pct": 0.0007
},
"share": 0,
"size": 14684160
},
"name": "metricbeat.exe",
"pgid": 0,
"pid": 4536,
"ppid": 568,
"state": "running",
"username": "NT AUTHORITY\\SYSTEM"
}
},
"type": "metricsets"
}
},
{
"_index": "metricbeat-6.0.0-alpha1-2017.04.20",
"_type": "doc",
"_id": "AVuKSXVUdFW3h5XRRqoG",
"_score": 0,
"_source": {
"@timestamp": "2017-04-20T08:29:19.921Z",
"beat": {
"hostname": "HPPP-01-DL20-Secondary",
"name": "HPPP-01-DL20-Secondary",
"version": "6.0.0-alpha1"
},
"metricset": {
"module": "system",
"name": "process",
"rtt": 3926
},
"system": {
"process": {
"cmdline": "\"C:\\Program Files\\metricbeat\\\\metricbeat.exe\" -c \"C:\\Program Files\\metricbeat\\\\metricbeat.yml\" -path.home \"C:\\Program Files\\metricbeat\" -path.data \"C:\\\\ProgramData\\\\metricbeat\"",
"cpu": {
"start_time": "2017-04-20T06:52:38.615Z",
"total": {
"pct": 0.094
}
},
"memory": {
"rss": {
"bytes": 24174592,
"pct": 0.0007
},
"share": 0,
"size": 14684160
},
"name": "metricbeat.exe",
"pgid": 0,
"pid": 4536,
"ppid": 568,
"state": "running",
"username": "NT AUTHORITY\\SYSTEM"
}
},
"type": "metricsets"
}
},
{
"_index": "metricbeat-6.0.0-alpha1-2017.04.20",
"_type": "doc",
"_id": "AVuKffLtdFW3h5XRRycS",
"_score": 0,
"_source": {
"@timestamp": "2017-04-20T09:26:39.939Z",
"beat": {
"hostname": "HPPP-01-DL20-Secondary",
"name": "HPPP-01-DL20-Secondary",
"version": "6.0.0-alpha1"
},
"metricset": {
"module": "system",
"name": "process",
"rtt": 3899
},
"system": {
"process": {
"cmdline": "\"C:\\Program Files\\metricbeat\\\\metricbeat.exe\" -c \"C:\\Program Files\\metricbeat\\\\metricbeat.yml\" -path.home \"C:\\Program Files\\metricbeat\" -path.data \"C:\\\\ProgramData\\\\metricbeat\"",
"cpu": {
"start_time": "2017-04-20T06:52:38.615Z",
"total": {
"pct": 0.0942
}
},
"memory": {
"rss": {
"bytes": 24285184,
"pct": 0.0007
},
"share": 0,
"size": 14684160
},
"name": "metricbeat.exe",
"pgid": 0,
"pid": 4536,
"ppid": 568,
"state": "running",
"username": "NT AUTHORITY\\SYSTEM"
}
},
"type": "metricsets"
}
}
]
}
}