Disable modules in Metricbeat.yml

Elastic Stack Beats
1

I am pretty new to Elastic and Beats, hence looking for some quick help!
I am trying to disable some default modules like (system, aerospike etc) in metricbeat.yml using the following configuration, but this is not having any impact. Can anyone guide me how to do this?

  • module: system
    metricsets: ["cpu"]
    enabled: false
    perdiod: 1s
2

Please format logs, configs and terminal input/output using the </>-Button or markdown code fences. This forum uses Markdown to format posts. Without proper formatting, it can be very hard to read your posts.

Config files using YAML are sensitive to formatting and indentation. Without proper formatting it is difficult to spot any errors in your configs.

Please post your complete metricbeat modules section and format it, so we can have a look for errors.

Btw. you can also comment out a module using the # character.

3

yml
metricbeat.yml.png543×537 10.6 KB

Please find attached screenshot of my metricbeat.yml file

4

Please do not post pictures of text. Not everyone can read the text from screenshots. Plus, it makes it difficult to edit/validate configs.

From picture I'd say it looks fine. Why do you think disabling modules has no impact? You see aerospike events in you index (the module is not even listed)?

5

Sorry for attaching the screen shot, as I was looking for a quick solution and I was not able to attach the .yml file directly (don't know why it just allowed me jpg/png image for upload).
I can see all the modules (with their metricsets and fields) when I create an index on the beat files. I haven't added any modules explicitly. I thought they are default enabled and need to be disabled if I don't want the fields to be shown.
Also my metricbeat and elk both are running in a docker container.

I am new to elastic search and metric beat so I am not sure what am I missing.

Thanks for your response

6

No modules are enabled by default. You have to configure enabled modules explicitly. What you are seeing is all known fields known to the index mapping. The mapping template installed in Elasticsearch adds all fields and types. Still, this doesn't mean you have any events from these modules.

This behavior can not be disabled right now. But you can export and manually adapt the template mapping (or fields.yml), by removing all fields you don't want to see.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.