Filebeat 6.2 seems to be monitoring the server it's running on?

Elastic Stack Beats
1

I upgraded one of my servers to filebeat 6.2 to test it out and everything seems to work fine but now I'm getting these lines in the log file constantly:

2018-02-07T09:55:12.077-0500    INFO    [monitoring]    log/log.go:124  Non-zero metrics in the last 30s        {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"tic\
ks":70,"time":74},"total":{"ticks":350,"time":360,"value":350},"user":{"ticks":280,"time":286}},"info":{"ephemeral_id":"980b9b03-bf44-494b-8911-be176eb29bd7","uptime":{"\
ms":30014}},"memstats":{"gc_next":6974496,"memory_alloc":5717152,"memory_total":57507792,"rss":20787200}},"filebeat":{"events":{"active":22,"added":1316,"done":1294},"ha\
rvester":{"open_files":4,"running":4,"started":4}},"libbeat":{"config":{"module":{"running":4,"starts":4},"reloads":1},"output":{"events":{"acked":1282,"batches":28,"tot\
al":1282},"read":{"bytes":168},"type":"logstash","write":{"bytes":189400}},"pipeline":{"clients":8,"events":{"active":22,"filtered":12,"published":1304,"retry":60,"total\
":1316},"queue":{"acked":1282}}},"registrar":{"states":{"current":12,"update":1294},"writes":40},"system":{"cpu":{"cores":32},"load":{"1":5.54,"15":4.42,"5":4.71,"norm":\
{"1":0.1731,"15":0.1381,"5":0.1472}}}}}}

It seems like filebeat is doing something similar to metricbeat all of a sudden? How do I make this stop? Thanks!

2

New metrics has been added to all Beats, e.g CPU usage, uptime, etc. Right now it is not possible to turn off the logging of new metrics.
Please, open an issue, if you need it to be configurable: https://github.com/elastic/beats/issues/new

3

Thanks, a few questions.
Is there documentation somewhere about this change?
Why add this to filebeat when you have metricbeat for this exact purpose?
Is it actually sending this information to my logstash servers?

4

I haven't found documentation on it. But it's in the blogpost announcing 6.2 release and also in the release notes.


https://www.elastic.co/guide/en/beats/libbeat/6.2/release-notes-6.2.0.html
I have also seen docs on the topic in the repo, but I cannot find it on our website. I will edit this post if I find it in the meantime.

This is reported by all Beats, including Packetbeat, Auditbeat, Filebeat, Metricbeat and Winlogbeat. Other Elastic products were already reported similar metrics to X-Pack. Beats is catching up now. As you can see in the blogpost, the collected data is visualized in Kibana.

By default, it's only printed to the logs, as you pasted in your initial comment.
If you add

xpack.monitoring.enabled: true

to you config monitoring events are sent to an Elasticsearch instance. Logstash does not receive this data, unless you send the log of Filebeat to Logstash.

Let me know if you need further information.

Edit: I found the documentation: https://www.elastic.co/guide/en/beats/filebeat/current/monitoring.html

5

Logging non-zero metrics every 30s is no new feature, but has been in beats since 5.x. Only the format seems to have been changed from flattened names to json.

As these metrics are provided by the logging module, checkout the logging.metrics.enabled setting.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.