Drop_event equals condition does not work on floats

In using the metricbeat with the system module, I'm trying to drop process events where certain conditions are true. I have configured my yml file with the below processor and the configuration tests ok. However the events are still output to my kafka broker. What am I doing wrong?


#==========================  Modules configuration ============================
metricbeat.modules:

#------------------------------- System Module -------------------------------
- module: system
  metricsets:
    - cpu

    # System Load stats
    - load

    # Per CPU core stats
    #- core

    # IO stats
    - diskio

    # Per filesystem stats
    - filesystem

    # File system summary stats
    - fsstat

    # Memory stats
    - memory

    # Network stats
    - network

    # Per process stats
    - process
  enabled: true
  period: 10s
  processes: ['.*']

#======processors==============

processors:
  - drop_event:
          when:
           and:
            - equals:
                 system.process.cpu.total.pct: 0
            - equals:
                 system.process.memory.rss.bytes: 0

#================================ Outputs =====================================

# Configure what outputs to use when sending the data collected by the beat.
# Multiple outputs may be used.
output.kafka:
  hosts: ["my_host@port"]
  topic: 'metricbeat'
  partition.round_robin:
    reachable_only: false
  version: "0.10.0.0"

#================================ Logging =====================================

# Sets log level. The default log level is error.
# Available log levels are: critical, error, warning, info, debug
#logging.level: debug

# At debug level, you can selectively enable logging only for some components.
# To enable all selectors use ["*"]. Examples of other selectors are "beat",
# "publish", "service".
logging.selectors: ["*"]
logging.level: debug
logging.files:
  path: /var/log/mybeat

Based on the docs, equals works on integers and strings. But the pct is a float inside of metricbeat. Could you try:

processors:
  - drop_event:
          when:
           and:
            - range:
                 system.process.cpu.total.pct:
                   lte: 0.0
            - equals:
                 system.process.memory.rss.bytes: 0

Thank you Andrew! That works.
Perhaps this level of detail can be included in the Processor section?

This topic was automatically closed after 21 days. New replies are no longer allowed.