Config files

[LevavasseurYann]

Required informations

• Beat version: 6.4.3
• Operating System: Debian9, Docker
• Configuration: The issue itslef

Description

I'm using Metricbeat with Docker module and Vsphere module to feed an Elasticsearch and read the metrics from Grafana. The entire configuration is correctly runnig but at first i've notice the huge amount of docs generated by metricbeat each days (around 2M ~5Go) as a hint to a possible issue. In fact after a little investigation i've noticed timestamp beetewen my docs weren't according with the period setup, and my docs were acting like i'm having for the system module a field with 10s periode and a second with 20s. In my metricbeat.yml i've setup the system module to run with metric [percentage, normalize_percentage] and a period of 20s.
I came with two possible sources for this issue:

1: Metricbeat do not override the system.yml file in module.d directory which is setup to period every 10s
2: the [normalize_percentage] for CPU metric can't handle a period of 20s

The second idea is the one with more credit cause this is the normalize field that keep period at 10s regarding my query.

Question ?

How to i setup the normalize_percentage for CPU at 20s period ? Is this issue wellknow ?
Is this an other issue ?

[jsoriano (Jaime Soriano)]

Hi @LevavasseurYann and welcome

When you mention that Metricbeat is not overriding the system.yml file, what do you mean? Do you have the system module configured in multiple places?

Take into account that if you have a module configured in multiple places, configuration is not overriden, but multiple modules are instantiated. This could explain that you are seeing more events than expected.

[LevavasseurYann]

Hello, thanks for the response,

I've managed to fix my problem, i think. I finaly got what i'm expecting for but remain confusion in my mind. In the first place i thought metricbeat.yml once configured was the only one readed by metricbeat, but in fact both metricbeat.yml and system.yml are read, right ?

I've deleted the metrics in the system.yml that had the same periods as thoses in metricbeat.yml and now it's working fine, i couldn't disable the module because it's running on docker(woulnd't remain after reload).

Did i fix it the proper way ?

The files:

Metricbeat.yml

metricbeat.modules:
- module: system
  period: 20s
  metricsets:
    - cpu
    - load
    - memory
    - network
    #- process
    - process_summary
    - core
    - diskio
    #- socket
  cpu.metrics: [percentages, normalized_percentages]
  core.metrics: [percentages]`

system.yml

- module: system
  period: 1m
  metricsets:
    - filesystem
    - fsstat
  processors:
  - drop_event.when.regexp:
      system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|host|lib)($|/)'

- module: system
  period: 15m
  metricsets:
    - uptime

[jsoriano (Jaime Soriano)]

In the first place i thought metricbeat.yml once configured was the only one readed by metricbeat, but in fact both metricbeat.yml and system.yml are read, right ?

Yes, if a module is configured multiple times in multiple files, all of them are read and multiple instances of the module are started. You can chose to add the configuration both in the main metricbeat.yml file or in the specific module files. I'd recommend to use only one of both options to avoid confusions.