# Config files

**URL:** <https://discuss.elastic.co/t/config-files/161368>\
**Category:** Beats\
**Tags:** docker, metricbeat\
**Created:** [December 18, 2018, 4:09pm UTC](https://discuss.elastic.co/t/config-files/161368 "2018-12-18T16:09:39Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![LevavasseurYann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/levavasseuryann/32/38943_2.png) [@LevavasseurYann](https://discuss.elastic.co/u/LevavasseurYann)\
**Post date:** [December 18, 2018, 4:09pm UTC](https://discuss.elastic.co/t/config-files/161368/1 "2018-12-18T16:09:39Z")

</div>

## Required informations

- Beat version: 6.4.3
- Operating System: Debian9, Docker
- Configuration: The issue itslef

## Description

I'm using Metricbeat with Docker module and Vsphere module to feed an Elasticsearch and read the metrics from Grafana. The entire configuration is correctly runnig but at first i've notice the huge amount of docs generated by metricbeat each days (around 2M ~5Go) as a hint to a possible issue. In fact after a little investigation i've noticed timestamp beetewen my docs weren't according with the period setup, and my docs were acting like i'm having for the system module a field with 10s periode and a second with 20s. In my metricbeat.yml i've setup the system module to run with metric [percentage, normalize\_percentage] and a period of 20s.  
I came with two possible sources for this issue:

> 1: Metricbeat do not override the system.yml file in module.d directory which is setup to period every 10s  
> 2: the [normalize\_percentage] for CPU metric can't handle a period of 20s

The second idea is the one with more credit cause this is the normalize field that keep period at 10s regarding my query.

## Question ?

How to i setup the normalize\_percentage for CPU at 20s period ? Is this issue wellknow ?  
Is this an other issue ?

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [December 19, 2018, 4:34pm UTC](https://discuss.elastic.co/t/config-files/161368/2 "2018-12-19T16:34:12Z")

</div>

Hi @LevavasseurYann and welcome 🙂

When you mention that Metricbeat is not overriding the `system.yml` file, what do you mean? Do you have the system module configured in multiple places?

Take into account that if you have a module configured in multiple places, configuration is not overriden, but multiple modules are instantiated. This could explain that you are seeing more events than expected.

---

<div class="post-metadata">

**Author:** ![LevavasseurYann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/levavasseuryann/32/38943_2.png) [@LevavasseurYann](https://discuss.elastic.co/u/LevavasseurYann)\
**Post date:** [December 19, 2018, 4:58pm UTC](https://discuss.elastic.co/t/config-files/161368/3 "2018-12-19T16:58:37Z")

</div>

Hello, thanks for the response,

I've managed to fix my problem, i think. I finaly got what i'm expecting for but remain confusion in my mind. In the first place i thought `metricbeat.yml` once configured was the only one readed by metricbeat, but in fact both `metricbeat.yml` and `system.yml` are read, right ?

I've deleted the metrics in the `system.yml` that had the same periods as thoses in `metricbeat.yml` and now it's working fine, i couldn't disable the module because it's running on docker(woulnd't remain after reload).

Did i fix it the proper way ?

The files:

**Metricbeat.yml**

```
metricbeat.modules:
- module: system
  period: 20s
  metricsets:
    - cpu
    - load
    - memory
    - network
    #- process
    - process_summary
    - core
    - diskio
    #- socket
  cpu.metrics: [percentages, normalized_percentages]
  core.metrics: [percentages]`

```

**system.yml**

```
- module: system
  period: 1m
  metricsets:
    - filesystem
    - fsstat
  processors:
  - drop_event.when.regexp:
      system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|host|lib)($|/)'

- module: system
  period: 15m
  metricsets:
    - uptime
```

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [December 19, 2018, 5:03pm UTC](https://discuss.elastic.co/t/config-files/161368/4 "2018-12-19T17:03:14Z")

</div>

> In the first place i thought `metricbeat.yml` once configured was the only one readed by metricbeat, but in fact both `metricbeat.yml` and `system.yml` are read, right ?

Yes, if a module is configured multiple times in multiple files, all of them are read and multiple instances of the module are started. You can chose to add the configuration both in the main `metricbeat.yml` file or in the specific module files. I'd recommend to use only one of both options to avoid confusions.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 16, 2019, 5:03pm UTC](https://discuss.elastic.co/t/config-files/161368/5 "2019-01-16T17:03:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.