Bug - Regex parsing for procs setting in topbeat.yml

Elastic Stack Beats
1

Hi,

It looks like there is a bug with respect to the 'procs' setting in topbeat.yml.

We followed the instructions on https://www.elastic.co/guide/en/beats/topbeat/current/topbeat-configuration.html and we use the following regular expression for the 'procs' setting: procs: ["^$"] (as we're not interested in monitoring processes). After restarting the topbeat service all processes are still monitored.

When we change the setting to procs: ["^mongod$"] only the mongod process is monitored. This works as expected.

It looks like the '^$' regex is not correctly parsed?

We're using debian.

Thanks in advance.

2

Use the following to disable procs:

input:
  stats:
    process: false

See: https://www.elastic.co/guide/en/beats/topbeat/current/configuration-input.html#_stats

There is a bug in 1.2.0 with regard to the $ character. We have prepared a fix and included it in the 5.0.0-alpha1.

/cc: @dedemorton I suggest updating the Topbeat Getting Started page to recommend the config snippit above where the page says "If you are not interested in monitoring processes, you can use:"

3

Hi Andrew,

Thanks for your reply. We're going to try the 'process: false' setting.

4

Hi Andrew,

Maybe this is also already fixed in the alpha version you mentioned, but the default topbeat.yml has a typo on line 18:
# per process statistics, by default is true proc: true
This should be:
# per process statistics, by default is true process: true

(we're using version 1.2.0)

5

It's not fixed. I noticed it while responding earlier and created an issue: https://github.com/elastic/beats/issues/1323

Thanks!