Can you add custom/dynamic fields to topbeat output?


(Maxwell Flanders) #1

We are using topbeats across a ton of servers to track cpu, mem, etc, and alerting on those fields using elastalert. It would be really nice if I could also add in some of my own custom fields/checks, for example, if a machine is using over 85% cpu, I'd like to add a field to my topbeats output that displays the name and size of the largest file on the system.

I know how to do these checks manually, but is there a way I can tell topbeats to run those checks for me, and place the output into a field??

This would be a magnificent feature if it existed.

Thanks!!


(ruflin) #2

Topbeat does not do any processing of the data so this functionality is not available.

The functionality that you describe sounds like you would want to execute an external script when a certain threshold is met?


(Maxwell Flanders) #3

I do not want topbeats to run anything based off of a threshold value, however, If I could write my own simple shell script like:

free -h | cut -f 1 (I know topbeats already provides memoryinformation, but this is just for the sake of example)

is there a way I could have topbeats run this script and place the output into an extra field?? It doesn't have to be triggered by any threshold, If topbeats could provide me the data, I can do any alerting myself.


(Tudor Golubenco) #4

That sounds somehow similar with what Execbeat (community beat: https://github.com/christiangalsterer/execbeat) is doing.


(system) #5