Estimating days left before disk saturation
Two time-filtered aggregations (14 days ago vs. today) give the daily growth, then extrapolated into the number of days until 100% usage.
Prerequisites
Elasticsearch 8.16+, Metricbeat filesystem
SQL
FROM "metrics-system.filesystem-*"
| WHERE system.filesystem.mount_point == "/data"
AND @timestamp >= NOW() - 14 days
| STATS
usage_il_y_a_14j = ROUND(AVG(system.filesystem.used.pct)
WHERE @timestamp < NOW() - 13 days, 2),
usage_actuel = ROUND(AVG(system.filesystem.used.pct)
WHERE @timestamp >= NOW() - 1 day, 2)
BY host.name
| EVAL croissance_pct_jour = ROUND((usage_actuel - usage_il_y_a_14j) * 100 / 13, 2)
| EVAL jours_avant_saturation = CASE(
croissance_pct_jour > 0,
ROUND((1.0 - usage_actuel) * 100 / croissance_pct_jour),
NULL)
| WHERE jours_avant_saturation IS NOT NULL AND jours_avant_saturation < 60
| SORT jours_avant_saturation ASC
| LIMIT 20Result
host.name | usage_il_y_a_14j | usage_actuel | croissance_pct_jour | jours_avant_saturation ------------+------------------+--------------+---------------------+----------------------- es-data-04 | 0.61 | 0.87 | 2.00 | 7 kafka-01 | 0.55 | 0.74 | 1.46 | 18 es-data-02 | 0.70 | 0.79 | 0.69 | 30 backup-srv | 0.48 | 0.62 | 1.08 | 35
Capacity PlanningDisquePrédictifSTATS