Query against float value, getting all results not just queried

I am logging disk utilization as a decimal representation of a percentage of 1. Right now, a disk I’m monitoring is at 79%, so it comes in as 0.79. (I’m pretty sure it’s numeric and stored as float: how can I confirm? It doesn’t have quotes in the incoming “message” json)

I’d like to chart a trend of nightly spikes of 90%, and the name of the application is sysmetrics, so I:

Query: application_name:sysmetrics details_disksda3percent:>0.85

However, what results is all the data points:


instead of just the spikes. Any ideas what I’m doing wrong? (Also a tip on the data type: Fwiw, when I create an Alert on this field contents, I am not given gt as an option, only exact match: Maybe that’s an indicator that it’s a string value?)


You have to check the Elasticsearch index mapping for that field:

I’d also recommend creating a custom Elasticsearch index template for your messages:

Query: application_name:sysmetrics details_disksda3percent:>0.85

You should Query like

application_name:sysmetrics AND details_disksda3percent:>0.85

Shoot… You’re right @jan! Hopefully it was just a copy/paste error on my part, but maybe not - - good catch!

Thanks @jochen. You’re right:

          "details_disksda3percent" : {
            "type" : "keyword"

Looks like most of all of my mappings are “keyword” with a couple exceptions that I initiated the index with of long. :frowning: I’m off to learn about re-mapping. I think Elasticsearch indices cannot be changed and that one is better off starting a new index? …

(Largely) correct. The mapping of an existing index can only be changed in a compatible manner (e. g. long to double), which pretty much restricts the possibilities.

I’d recommend starting new indices.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.