Topbeats: mem.used_p vs mem.actual_used_p

Elastic Stack Beats
1

What is the difference between these two?? I am seeing some crazy variation between these two numbers, 95% vs. .37, (I presumed meant 37%). Why are these two numbers so out of sync??

2

For a definition of the fields see the reference documentation: https://www.elastic.co/guide/en/beats/topbeat/current/exported-fields-system.html#_mem_actual_used

The code for the calculation on Linux is here: https://github.com/elastic/beats/blob/71bd823b19921ed025689e163163d28f7e0a7cc7/vendor/github.com/elastic/gosigar/sigar_linux.go#L82-L85

3

THANK YOU!! I couldnt find that part of the documentation for the life of me!!

4

And regarding the .37 vs %37, you can fix that by telling Kibana that the field is a percentage so that it can be formatted properly.

  1. Go to Settings
  2. Click on the topbeat-* index.
  3. Find the mem.actual_used_p field and click the edit button on the right.
  4. Change the format to Percentage and click update field.
5

Oh that's not good! We added Search capabilities recently that make it possible to search the entire doc set (or individual docs and releases). Did you try using this feature? It's super handy. Just click the magnifying icon from the main docs page: https://www.elastic.co/guide/index.html

6

That IS very helpful I didnt know that existed. Thanks!