Drop_event equals condition does not work on floats

Elastic Stack Beats
1

In using the metricbeat with the system module, I'm trying to drop process events where certain conditions are true. I have configured my yml file with the below processor and the configuration tests ok. However the events are still output to my kafka broker. What am I doing wrong?


#==========================  Modules configuration ============================
metricbeat.modules:

#------------------------------- System Module -------------------------------
- module: system
  metricsets:
    - cpu

    # System Load stats
    - load

    # Per CPU core stats
    #- core

    # IO stats
    - diskio

    # Per filesystem stats
    - filesystem

    # File system summary stats
    - fsstat

    # Memory stats
    - memory

    # Network stats
    - network

    # Per process stats
    - process
  enabled: true
  period: 10s
  processes: ['.*']

#======processors==============

processors:
  - drop_event:
          when:
           and:
            - equals:
                 system.process.cpu.total.pct: 0
            - equals:
                 system.process.memory.rss.bytes: 0

#================================ Outputs =====================================

# Configure what outputs to use when sending the data collected by the beat.
# Multiple outputs may be used.
output.kafka:
  hosts: ["my_host@port"]
  topic: 'metricbeat'
  partition.round_robin:
    reachable_only: false
  version: "0.10.0.0"

#================================ Logging =====================================

# Sets log level. The default log level is error.
# Available log levels are: critical, error, warning, info, debug
#logging.level: debug

# At debug level, you can selectively enable logging only for some components.
# To enable all selectors use ["*"]. Examples of other selectors are "beat",
# "publish", "service".
logging.selectors: ["*"]
logging.level: debug
logging.files:
  path: /var/log/mybeat
2

Based on the docs, equals works on integers and strings. But the pct is a float inside of metricbeat. Could you try:

processors:
  - drop_event:
          when:
           and:
            - range:
                 system.process.cpu.total.pct:
                   lte: 0.0
            - equals:
                 system.process.memory.rss.bytes: 0
3

Thank you Andrew! That works.
Perhaps this level of detail can be included in the Processor section?

4

This topic was automatically closed after 21 days. New replies are no longer allowed.