# Drop\_event on process (metric beat 5.6.2)

**URL:** <https://discuss.elastic.co/t/drop-event-on-process-metric-beat-5-6-2/103238>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [October 9, 2017, 2:06pm UTC](https://discuss.elastic.co/t/drop-event-on-process-metric-beat-5-6-2/103238 "2017-10-09T14:06:41Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Peter\_Steenbergen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/peter_steenbergen/32/22888_2.png) [@Peter\_Steenbergen](https://discuss.elastic.co/u/Peter_Steenbergen)\
**Post date:** [October 9, 2017, 2:06pm UTC](https://discuss.elastic.co/t/drop-event-on-process-metric-beat-5-6-2/103238/1 "2017-10-09T14:06:41Z")

</div>

Hi,

This is my config:

```
- module: system
  metricsets:
    - process
  enabled: true
  period: 60s
  processes: ['.*']
  process.cgroups.enabled: false
  processors:
    - drop_event.when.range:
      system.process.cpu.total.pct.lte: 1

```

I would like only the processes with a higher cpu than 1%. However it keeps pushing all the processes. What is the best way to do this in version 5.6.2?

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [October 10, 2017, 11:01am UTC](https://discuss.elastic.co/t/drop-event-on-process-metric-beat-5-6-2/103238/2 "2017-10-10T11:01:19Z")

</div>

I wonder if the problem above is related to indentation. Could you try:

```auto
  processors:
    - drop_event.when.range:
        system.process.cpu.total.pct.lte: 1

```

And if that does not work, try:

```auto
  processors:
    - drop_event:
        when:
          range:
            system.process.cpu.total.pct.lte: 1

```

Both should be identical.

---

<div class="post-metadata">

**Author:** ![Peter\_Steenbergen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/peter_steenbergen/32/22888_2.png) [@Peter\_Steenbergen](https://discuss.elastic.co/u/Peter_Steenbergen)\
**Post date:** [October 11, 2017, 6:47am UTC](https://discuss.elastic.co/t/drop-event-on-process-metric-beat-5-6-2/103238/3 "2017-10-11T06:47:53Z")

</div>

To bad, it still gives me back 147 processes, all of them are around 0.01%.  
Any idea's? Can it be because of processes: ['.\*'] entry. I tried removing it, but then I get no output whatsoever.

I am using version 5.6.2 but both both does not seem to trigger.  
My full list is this one.

```
#========================== Modules configuration ============================
metricbeat.modules:

#------------------------------- System Module -------------------------------
- module: system
  metricsets:
    - cpu
    - core
    - memory
    - network
  enabled: true
  period: 300s

- module: system
  metricsets:
    - filesystem
    - fsstat
    - diskio
  enabled: true
  period: 10m

- module: system
  metricsets:
    - load
  enabled: true
  period: 60s

- module: system
  metricsets:
    - process
  enabled: true
  period: 60s
  processes: ['.*']
  process.cgroups.enabled: false
  processors:
    - drop_event:
      when:
        range:
          system.process.cpu.total.pct.lte: 1

#================================ General =====================================

# The name of the shipper that publishes the network data. It can be used to group
# all the transactions sent by a single shipper in the web interface.
#name:

#----------------------------- Logstash output --------------------------------
output.logstash:
```

---

<div class="post-metadata">

**Author:** ![Peter\_Steenbergen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/peter_steenbergen/32/22888_2.png) [@Peter\_Steenbergen](https://discuss.elastic.co/u/Peter_Steenbergen)\
**Post date:** [October 11, 2017, 7:10am UTC](https://discuss.elastic.co/t/drop-event-on-process-metric-beat-5-6-2/103238/4 "2017-10-11T07:10:43Z")

</div>

This is the output when I run with the parameter -e.  
INFO Non-zero metrics in the last 30s: fetches.system-core.events=2 fetches.system-core.success=1 fetches.system-cpu.events=1 fetches.system-cpu.success=1 fetches.system-diskio.events=2 fetches.system-diskio.success=1 fetches.system-filesystem.events=31 fetches.system-filesystem.success=1 fetches.system-fsstat.events=1 fetches.system-fsstat.success=1 fetches.system-load.events=1 fetches.system-load.success=1 fetches.system-memory.events=1 fetches.system-memory.success=1 fetches.system-network.events=2 fetches.system-network.success=1 **fetches.system-process.events=155 fetches.system-process.success=1** libbeat.logstash.call\_count.PublishEvents=1 libbeat.logstash.publish.read\_bytes=5137 libbeat.logstash.publish.write\_bytes=15700 libbeat.logstash.published\_and\_acked\_events=196 libbeat.publisher.messages\_in\_worker\_queues=196 libbeat.publisher.published\_events=196

I can see that it fetches 155 processes but no processors (filter) is trigger so it seems.  
I put a '#' before processes: ['.\*'], and keeps pushing all the processes. With monitoring several hundreds of servers it will take our disk space very fast.

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [October 11, 2017, 10:20am UTC](https://discuss.elastic.co/t/drop-event-on-process-metric-beat-5-6-2/103238/5 "2017-10-11T10:20:47Z")

</div>

The `processors` configuration the way you use it has been added to 6.0 release only. In 5.6 it works a little different. You have to use:

```auto
- module: system
  ...
  filters:
    - drop_event.when.range:
        cpu.total.pct.lte: 1

```

The problem with 5.6 is, filtering happens on the not yet fully constructed event. That is, I'm not sure if you have to use `system.process.cpu.total....`, or just `process.cpu.total...` or just `cpu.total...`, or `total`...

---

<div class="post-metadata">

**Author:** ![Peter\_Steenbergen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/peter_steenbergen/32/22888_2.png) [@Peter\_Steenbergen](https://discuss.elastic.co/u/Peter_Steenbergen)\
**Post date:** [October 11, 2017, 1:22pm UTC](https://discuss.elastic.co/t/drop-event-on-process-metric-beat-5-6-2/103238/6 "2017-10-11T13:22:40Z")

</div>

I will try the filter. I got my code from the documentation from 5.6 as I can remember.  
Will come back when I try all the options.

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [October 11, 2017, 9:52pm UTC](https://discuss.elastic.co/t/drop-event-on-process-metric-beat-5-6-2/103238/7 "2017-10-11T21:52:01Z")

</div>

> I will try the filter. I got my code from the documentation from 5.6 as I can remember.

I see. This can very well be the case. But the `processors` setting in 5.6 is applied globally only, not per module. You have to remove all indentation to have something like:

```auto
metricbeat.modules:
- module: ...
  ...
- module: ...

processors:
- drop_event.when.range: ...

```

---

<div class="post-metadata">

**Author:** ![Peter\_Steenbergen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/peter_steenbergen/32/22888_2.png) [@Peter\_Steenbergen](https://discuss.elastic.co/u/Peter_Steenbergen)\
**Post date:** [October 11, 2017, 10:14pm UTC](https://discuss.elastic.co/t/drop-event-on-process-metric-beat-5-6-2/103238/8 "2017-10-11T22:14:25Z")

</div>

Ah oké, I did not noticed that processors are global. Have added the filter, and can see ik the morning if it works.

Then only another one for memory more then 30%.

Without the filters it kills the diskspace with several hundred servers.

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [October 12, 2017, 11:28am UTC](https://discuss.elastic.co/t/drop-event-on-process-metric-beat-5-6-2/103238/9 "2017-10-12T11:28:42Z")

</div>

@Peter_Steenbergen I think @steffens is right. Sorry that I missed that in my initial answer.

---

<div class="post-metadata">

**Author:** ![Peter\_Steenbergen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/peter_steenbergen/32/22888_2.png) [@Peter\_Steenbergen](https://discuss.elastic.co/u/Peter_Steenbergen)\
**Post date:** [October 12, 2017, 2:34pm UTC](https://discuss.elastic.co/t/drop-event-on-process-metric-beat-5-6-2/103238/10 "2017-10-12T14:34:00Z")

</div>

No problem. In the end this was the solution for me:

```
- module: system
  metricsets:
    - process
  enabled: true
  period: 15s
  process.cgroups.enabled: false
  filters:
    - drop_event.when.range:
        cpu.total.pct.lte: 0.10
        
- module: system
  metricsets:
    - process
  enabled: true
  period: 15s
  process.cgroups.enabled: false
  filters:
    - drop_event.when.range:
        memory.rss.pct.lte: 0.10

```

I found out though that 0.10 stands for 10%, 1 is 100%. So 1% would be 0.01. So now all my system events per 15s are being being processed when memory is 10% or cpu is 10% or more. Maybe I can chain it, but for now this would suffice.

Or do you guys have a solution for that?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 9, 2017, 2:34pm UTC](https://discuss.elastic.co/t/drop-event-on-process-metric-beat-5-6-2/103238/11 "2017-11-09T14:34:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.