Disable modules in Metricbeat.yml

[pvderivco (Poonam)]

I am pretty new to Elastic and Beats, hence looking for some quick help!
I am trying to disable some default modules like (system, aerospike etc) in metricbeat.yml using the following configuration, but this is not having any impact. Can anyone guide me how to do this?

• module: system
  metricsets: ["cpu"]
  enabled: false
  perdiod: 1s

[steffens (Steffen Siering)]

Please format logs, configs and terminal input/output using the </>-Button or markdown code fences. This forum uses Markdown to format posts. Without proper formatting, it can be very hard to read your posts.

Config files using YAML are sensitive to formatting and indentation. Without proper formatting it is difficult to spot any errors in your configs.

Please post your complete metricbeat modules section and format it, so we can have a look for errors.

Btw. you can also comment out a module using the # character.

[pvderivco (Poonam)]

Please find attached screenshot of my metricbeat.yml file

[steffens (Steffen Siering)]

Please do not post pictures of text. Not everyone can read the text from screenshots. Plus, it makes it difficult to edit/validate configs.

From picture I'd say it looks fine. Why do you think disabling modules has no impact? You see aerospike events in you index (the module is not even listed)?

[pvderivco (Poonam)]

Sorry for attaching the screen shot, as I was looking for a quick solution and I was not able to attach the .yml file directly (don't know why it just allowed me jpg/png image for upload).
I can see all the modules (with their metricsets and fields) when I create an index on the beat files. I haven't added any modules explicitly. I thought they are default enabled and need to be disabled if I don't want the fields to be shown.
Also my metricbeat and elk both are running in a docker container.

I am new to elastic search and metric beat so I am not sure what am I missing.

Thanks for your response

[steffens (Steffen Siering)]

No modules are enabled by default. You have to configure enabled modules explicitly. What you are seeing is all known fields known to the index mapping. The mapping template installed in Elasticsearch adds all fields and types. Still, this doesn't mean you have any events from these modules.

This behavior can not be disabled right now. But you can export and manually adapt the template mapping (or fields.yml), by removing all fields you don't want to see.