# Topbeat \_p fields on Windows hosts

**URL:** <https://discuss.elastic.co/t/topbeat--p-fields-on-windows-hosts/42638>\
**Category:** Beats\
**Created:** [February 24, 2016, 7:47pm UTC](https://discuss.elastic.co/t/topbeat--p-fields-on-windows-hosts/42638 "2016-02-24T19:47:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![meons](https://avatars.discourse-cdn.com/v4/letter/m/b5a626/32.png) [@meons](https://discuss.elastic.co/u/meons)\
**Post date:** [February 24, 2016, 7:47pm UTC](https://discuss.elastic.co/t/topbeat--p-fields-on-windows-hosts/42638/1 "2016-02-24T19:47:54Z")

</div>

Hi there,  
I have deployed Topbeat on some Windows 7 hosts but I see a problem when I analyse logs in Kibana:  
proc.mem.rss and proc.cpu.user fields recieve the correct data from hosts but proc.mem.rss\_p and proc.cpu.user\_p always have a 0 value, so I can't create graphs with percentages. I don't understand why those fields are not filled...

I have an another question about this page [https://www.elastic.co/guide/en/beats/topbeat/current/\_step\_6\_loading\_sample\_kibana\_dashboards.html#\_example\_of\_a\_system\_wide\_overview](https://www.elastic.co/guide/en/beats/topbeat/current/_step_6_loading_sample_kibana_dashboards.html#_example_of_a_system_wide_overview) Could you explain me how it's possible to have a value greater that 1 in column Average proc.mem.rss\_p (value 2.3 for line topbeat.exe -\> 230% ?!)

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [February 29, 2016, 2:33am UTC](https://discuss.elastic.co/t/topbeat--p-fields-on-windows-hosts/42638/2 "2016-02-29T02:33:34Z")

</div>

> [@meons](#):
>
> but proc.mem.rss\_p and proc.cpu.user\_p always have a 0 value

Most of my values are zero too, but not all of them. Try using the following query in Kibana to see if there are any.

`type:process AND (proc.cpu.user_p:>0 OR proc.mem.rss_p:>0)`

Here a data point from Topbeat 1.1.1 running on Windows 7 where both proc.cpu.user\_p \> 0 and proc.mem.rss\_p \> 0.

```auto
{
    "@timestamp": "2016-02-29T02:05:35.127Z",
    "beat": {
      "hostname": "win7-on-osx",
      "name": "win7-on-osx"
    },
    "count": 1,
    "proc": {
      "cpu": {
        "user": 3734,
        "user_p": 0.07,
        "system": 1609,
        "total": 5343,
        "start_time": "Aug09"
      },
      "mem": {
        "size": 36691968,
        "rss": 64774144,
        "rss_p": 0.03,
        "share": 0
      },
      "name": "chrome.exe",
      "pid": 11120,
      "ppid": 0,
      "state": "running"
    },
    "type": "process"
  }

```

We have made a [change](https://github.com/elastic/beats/pull/641/files#diff-23bc6c12c565c7dae599da1689af8261R439) (not released yet) to increase the precision on the CPU percentage to 4 decimal places. With version 1.1.1 the percentage is just 2 decimal places, so a lot of the time CPU percentage ends up as 0 because it's less than 0.05 and it rounds down. There was no change to rss\_p.

> [@meons](#):
>
> how it's possible to have a value greater that 1 in column Average proc.mem.rss\_p

I haven't seen this in my data. I just did a search over the last 30 days for values greater that 1. Maybe that image was generated from an old version (@monica do you know?). If you see that problem in your data, report it here.

---

<div class="post-metadata">

**Author:** ![meons](https://avatars.discourse-cdn.com/v4/letter/m/b5a626/32.png) [@meons](https://discuss.elastic.co/u/meons)\
**Post date:** [March 3, 2016, 6:34pm UTC](https://discuss.elastic.co/t/topbeat--p-fields-on-windows-hosts/42638/3 "2016-03-03T18:34:35Z")

</div>

Thank you for your response @andrewkroh  
Topbeat is installed on 7 hosts and send data every 1 min. If I try your query (proc.cpu.user\_p:\>0 OR proc.mem.rss\_p:\>0) I get only 7 hits with "Last 24 hours" timestamp and 35 hits with "Last 7 days" timestamp, it's really poor compared to expected result.  
One more thing to give you all information. Topbeat is configured to send data to a Logstash server (input beats) where I just add some fields (filter) brefore forward it to Elasticsearch (output elastic). So I don't think that's linked with my issue.  
Do you have any other ideas for this issue?

About the 2nd issue I didn't see that in my data but I just was surprised when I saw this value because it's not logical. Anyway I will let you know if I see something like that in prod.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:55pm UTC](https://discuss.elastic.co/t/topbeat--p-fields-on-windows-hosts/42638/4 "2017-07-05T21:55:03Z")

</div>