title: how to query metricbeat system cpu and memory data stored in elasticsearch 6.3
body: <p>i am using metricbeat on my servers to collect system metrics and store it in elasticsearch, and for some reason i do not want to use kibana to preview or get the data i want, for example i want to query cpu usage and memory usage from elasticsearch, i have did a lot of researches but i cannot find something clear that i can understand, 
  i am using elastic 6.3
  What i have done so far</p>
  
  <pre><code>http://localhost:9200/metricbeat*/_search
  {
  "took": 5,
  "timed_out": false,
  "_shards": {
      "total": 1,
      "successful": 1,
      "skipped": 0,
      "failed": 0
  },
  "hits": {
      "total": 1830,
      "max_score": 1,
      "hits": [
          {
              "_index": "metricbeat-6.3.0-2018.07.12",
              "_type": "doc",
              "_id": "RImkjWQBakcGABbiLI2H",
              "_score": 1,
              "_source": {
                  "@timestamp": "2018-07-12T08:38:23.128Z",
                  "metricset": {
                      "name": "load",
                      "module": "system",
                      "rtt": 86
                  },
                  "system": {
                      "load": {
                          "1": 1.02,
                          "5": 0.95,
                          "15": 0.66,
                          "norm": {
                              "1": 0.255,
                              "5": 0.2375,
                              "15": 0.165
                          },
                          "cores": 4
                      }
                  },
                  "beat": {
                      "name": "localhost.localdomain",
                      "hostname": "localhost.localdomain",
                      "version": "6.3.0"
                  },
                  "host": {
                      "name": "localhost.localdomain"
                  }
              }
          },
          {
              "_index": "metricbeat-6.3.0-2018.07.12",
              "_type": "doc",
              "_id": "RYmkjWQBakcGABbiLI2I",
              "_score": 1,
              "_source": {
                  "@timestamp": "2018-07-12T08:38:23.129Z",
                  "beat": {
                      "name": "localhost.localdomain",
                      "hostname": "localhost.localdomain",
                      "version": "6.3.0"
                  },
                  "host": {
                      "name": "localhost.localdomain"
                  },
                  "metricset": {
                      "rtt": 725,
                      "name": "memory",
                      "module": "system"
                  },
                  "system": {
                      "memory": {
                          "total": 3956293632,
                          "used": {
                              "bytes": 3824742400,
                              "pct": 0.9667
                          },
                          "free": 131551232,
                          "actual": {
                              "used": {
                                  "pct": 0.7733,
                                  "bytes": 3059421184
                              },
                              "free": 896872448
                          },
                          "swap": {
                              "total": 2147479552,
                              "used": {
                                  "pct": 0,
                                  "bytes": 0
                              },
                              "free": 2147479552
                          },
                          "hugepages": {
                              "used": {
                                  "bytes": 0,
                                  "pct": 0
                              },
                              "free": 0,
                              "reserved": 0,
                              "surplus": 0,
                              "default_size": 2097152,
                              "total": 0
                          }
                      }
                  }
              }
          },
          {
              "_index": "metricbeat-6.3.0-2018.07.12",
              "_type": "doc",
              "_id": "RomkjWQBakcGABbiLI2I",
              "_score": 1,
              "_source": {
                  "@timestamp": "2018-07-12T08:38:23.131Z",
                  "metricset": {
                      "name": "filesystem",
                      "module": "system",
                      "rtt": 229
                  },
                  "system": {
                      "filesystem": {
                          "free": 0,
                          "files": 0,
                          "free_files": 0,
                          "type": "fuse.gvfsd-fuse",
                          "device_name": "gvfsd-fuse",
                          "mount_point": "/run/user/1000/gvfs",
                          "total": 0,
                          "available": 0,
                          "used": {
                              "bytes": 0,
                              "pct": 0
                          }
                      }
                  },
                  "beat": {
                      "name": "localhost.localdomain",
                      "hostname": "localhost.localdomain",
                      "version": "6.3.0"
                  },
                  "host": {
                      "name": "localhost.localdomain"
                  }
              }
          },
          {
              "_index": "metricbeat-6.3.0-2018.07.12",
              "_type": "doc",
              "_id": "R4mkjWQBakcGABbiLI2I",
              "_score": 1,
              "_source": {
                  "@timestamp": "2018-07-12T08:38:23.131Z",
                  "metricset": {
                      "name": "filesystem",
                      "module": "system",
                      "rtt": 257
                  },
                  "system": {
                      "filesystem": {
                          "mount_point": "/",
                          "total": 28968488960,
                          "available": 19802587136,
                          "type": "xfs",
                          "device_name": "/dev/mapper/centos-root",
                          "free": 19802587136,
                          "free_files": 13836527,
                          "used": {
                              "pct": 0.3164,
                              "bytes": 9165901824
                          },
                          "files": 14151680
                      }
                  },
                  "beat": {
                      "name": "localhost.localdomain",
                      "hostname": "localhost.localdomain",
                      "version": "6.3.0"
                  },
                  "host": {
                      "name": "localhost.localdomain"
                  }
              }
          },
          {
              "_index": "metricbeat-6.3.0-2018.07.12",
              "_type": "doc",
              "_id": "SImkjWQBakcGABbiLI2I",
              "_score": 1,
              "_source": {
                  "@timestamp": "2018-07-12T08:38:23.131Z",
                  "beat": {
                      "name": "localhost.localdomain",
                      "hostname": "localhost.localdomain",
                      "version": "6.3.0"
                  },
                  "host": {
                      "name": "localhost.localdomain"
                  },
                  "metricset": {
                      "name": "filesystem",
                      "module": "system",
                      "rtt": 263
                  },
                  "system": {
                      "filesystem": {
                          "free_files": 523961,
                          "device_name": "/dev/sda1",
                          "mount_point": "/boot",
                          "files": 524288,
                          "type": "xfs",
                          "total": 1063256064,
                          "available": 885817344,
                          "free": 885817344,
                          "used": {
                              "bytes": 177438720,
                              "pct": 0.1669
                          }
                      }
                  }
              }
          },
          {
              "_index": "metricbeat-6.3.0-2018.07.12",
              "_type": "doc",
              "_id": "SYmkjWQBakcGABbiLI2I",
              "_score": 1,
              "_source": {
                  "@timestamp": "2018-07-12T08:38:23.131Z",
                  "system": {
                      "cpu": {
                          "iowait": {
                              "pct": 0.001
                          },
                          "irq": {
                              "pct": 0
                          },
                          "softirq": {
                              "pct": 0.0021
                          },
                          "cores": 4,
                          "idle": {
                              "pct": 3.4226
                          },
                          "nice": {
                              "pct": 0
                          },
                          "user": {
                              "pct": 0.45
                          },
                          "system": {
                              "pct": 0.1243
                          },
                          "steal": {
                              "pct": 0
                          },
                          "total": {
                              "pct": 0.5774
                          }
                      }
                  },
                  "beat": {
                      "version": "6.3.0",
                      "name": "localhost.localdomain",
                      "hostname": "localhost.localdomain"
                  },
                  "host": {
                      "name": "localhost.localdomain"
                  },
                  "metricset": {
                      "name": "cpu",
                      "module": "system",
                      "rtt": 357
                  }
              }
          },
          {
              "_index": "metricbeat-6.3.0-2018.07.12",
              "_type": "doc",
              "_id": "SomkjWQBakcGABbiLI2I",
              "_score": 1,
              "_source": {
                  "@timestamp": "2018-07-12T08:38:23.131Z",
                  "system": {
                      "uptime": {
                          "duration": {
                              "ms": 562000
                          }
                      }
                  },
                  "beat": {
                      "version": "6.3.0",
                      "name": "localhost.localdomain",
                      "hostname": "localhost.localdomain"
                  },
                  "host": {
                      "name": "localhost.localdomain"
                  },
                  "metricset": {
                      "module": "system",
                      "rtt": 16,
                      "name": "uptime"
                  }
              }
          },
          {
              "_index": "metricbeat-6.3.0-2018.07.12",
              "_type": "doc",
              "_id": "S4mkjWQBakcGABbiLI2I",
              "_score": 1,
              "_source": {
                  "@timestamp": "2018-07-12T08:38:23.131Z",
                  "host": {
                      "name": "localhost.localdomain"
                  },
                  "beat": {
                      "name": "localhost.localdomain",
                      "hostname": "localhost.localdomain",
                      "version": "6.3.0"
                  },
                  "metricset": {
                      "name": "fsstat",
                      "module": "system",
                      "rtt": 643
                  },
                  "system": {
                      "fsstat": {
                          "count": 3,
                          "total_files": 14675968,
                          "total_size": {
                              "free": 20688404480,
                              "used": 9343340544,
                              "total": 30031745024
                          }
                      }
                  }
              }
          },
          {
              "_index": "metricbeat-6.3.0-2018.07.12",
              "_type": "doc",
              "_id": "TImkjWQBakcGABbiLI2I",
              "_score": 1,
              "_source": {
                  "@timestamp": "2018-07-12T08:38:23.131Z",
                  "metricset": {
                      "name": "network",
                      "module": "system",
                      "rtt": 1057
                  },
                  "system": {
                      "network": {
                          "name": "lo",
                          "in": {
                              "errors": 0,
                              "dropped": 0,
                              "bytes": 260748,
                              "packets": 975
                          },
                          "out": {
                              "dropped": 0,
                              "packets": 975,
                              "bytes": 260748,
                              "errors": 0
                          }
                      }
                  },
                  "beat": {
                      "name": "localhost.localdomain",
                      "hostname": "localhost.localdomain",
                      "version": "6.3.0"
                  },
                  "host": {
                      "name": "localhost.localdomain"
                  }
              }
          },
          {
              "_index": "metricbeat-6.3.0-2018.07.12",
              "_type": "doc",
              "_id": "TYmkjWQBakcGABbiLI2I",
              "_score": 1,
              "_source": {
                  "@timestamp": "2018-07-12T08:38:23.131Z",
                  "metricset": {
                      "rtt": 1087,
                      "name": "network",
                      "module": "system"
                  },
                  "system": {
                      "network": {
                          "name": "virbr0-nic",
                          "in": {
                              "errors": 0,
                              "dropped": 0,
                              "bytes": 0,
                              "packets": 0
                          },
                          "out": {
                              "errors": 0,
                              "dropped": 0,
                              "packets": 0,
                              "bytes": 0
                          }
                      }
                  },
                  "beat": {
                      "name": "localhost.localdomain",
                      "hostname": "localhost.localdomain",
                      "version": "6.3.0"
                  },
                  "host": {
                      "name": "localhost.localdomain"
                  }
              }
          }
      ]
  }
  </code></pre>
  
  <p>so for example if i want to query system cpu user/nice/system/ total</p>
  
  <p>and memory total and used, also is there is a way to query data for example if i want to query cpu:user usage that are above 80% how to do it </p>
  
  <p>appreciate your patience and help </p>