Convert Bytes to Gigabytes

[yangcaixing]

Hi all,
I have a question about ELK query, I use DSL to query client ip and traffic, but the totally sum traffic is default format bytes, how can I calculate and convert to Gigabytes, if anyone can help me, thanks a lot.

[mihirsoni]

Hi @yangcaixing

There are couple of ways to solve this, simple way would be

Convert your threshold to bytes (i.e 1GB = 1073741824 bytes source https://whatsabyte.com/P1/byteconverter.htm) and use this as condition.

Another approach would be to do this calculation as part of your query, you can use script_field to do this calculation.

[yangcaixing]

Hi @mihirsoni,
I try to use the script_field in query as below ,but it doesn’t works, I don’t know if the script location is right or not, could you help check this thanks very much.
“aggregations”: {
“client_host”: {
“terms”: {
“field”: “flow.client_hostname”,
“size”: 10,
“min_doc_count”: 1,
“shard_min_doc_count”: 0,
“show_term_doc_count_error”: false,
“order”: [
{
“total_bytes”: “desc”
},
{
“_count”: “desc”
},
{
“_key”: “asc”
}
]
},
“aggregations”: {
“total_bytes”: {
“sum”: {
“field”: “flow.bytes”
},
“script_fields”: {
“test”: {
“script”: {
“lang”: “painless”,
“source”: “doc[‘flow.bytes’].value /1024 /1024 /1024”
}
}
}
},
“bytes_bucket_filter”: {
“bucket_selector”: {
“buckets_path”: {
“totalBytes”: “total_bytes”
},
“script”: {
“source”: “params.totalBytes > 1”,
“lang”: “painless”
},
“gap_policy”: “skip”
}
}
}
}
}

[yangcaixing]

Hi @mihirsoni,
I used below script to calculate, but it seems wrong, the value always equal 0, would please help have a look, thanks a lot.

[yangcaixing]

Hi @mihirsoni
I have solved the case , thanks so much for the support from beginning, it make a great help for me to achieve the goals, hope you been well all the time.

[mashraf]

Hi @yangcaixing hope you doing fine, i am facing the same issue in retrieving the sum in bytes and wants to show the value in GBs or MBs could you please help with this.

.