# Filebeat 6.2 seems to be monitoring the server it's running on?

**URL:** <https://discuss.elastic.co/t/filebeat-6-2-seems-to-be-monitoring-the-server-its-running-on/118865>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 7, 2018, 3:08pm UTC](https://discuss.elastic.co/t/filebeat-6-2-seems-to-be-monitoring-the-server-its-running-on/118865 "2018-02-07T15:08:04Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Warren\_Turner](https://avatars.discourse-cdn.com/v4/letter/w/e9c0ed/32.png) [@Warren\_Turner](https://discuss.elastic.co/u/Warren_Turner)\
**Post date:** [February 7, 2018, 3:08pm UTC](https://discuss.elastic.co/t/filebeat-6-2-seems-to-be-monitoring-the-server-its-running-on/118865/1 "2018-02-07T15:08:04Z")

</div>

I upgraded one of my servers to filebeat 6.2 to test it out and everything seems to work fine but now I'm getting these lines in the log file constantly:

```
2018-02-07T09:55:12.077-0500 INFO [monitoring] log/log.go:124 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"tic\
ks":70,"time":74},"total":{"ticks":350,"time":360,"value":350},"user":{"ticks":280,"time":286}},"info":{"ephemeral_id":"980b9b03-bf44-494b-8911-be176eb29bd7","uptime":{"\
ms":30014}},"memstats":{"gc_next":6974496,"memory_alloc":5717152,"memory_total":57507792,"rss":20787200}},"filebeat":{"events":{"active":22,"added":1316,"done":1294},"ha\
rvester":{"open_files":4,"running":4,"started":4}},"libbeat":{"config":{"module":{"running":4,"starts":4},"reloads":1},"output":{"events":{"acked":1282,"batches":28,"tot\
al":1282},"read":{"bytes":168},"type":"logstash","write":{"bytes":189400}},"pipeline":{"clients":8,"events":{"active":22,"filtered":12,"published":1304,"retry":60,"total\
":1316},"queue":{"acked":1282}}},"registrar":{"states":{"current":12,"update":1294},"writes":40},"system":{"cpu":{"cores":32},"load":{"1":5.54,"15":4.42,"5":4.71,"norm":\
{"1":0.1731,"15":0.1381,"5":0.1472}}}}}}

```

It seems like filebeat is doing something similar to metricbeat all of a sudden? How do I make this stop? Thanks!

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [February 7, 2018, 4:19pm UTC](https://discuss.elastic.co/t/filebeat-6-2-seems-to-be-monitoring-the-server-its-running-on/118865/2 "2018-02-07T16:19:28Z")

</div>

New metrics has been added to all Beats, e.g CPU usage, uptime, etc. Right now it is not possible to turn off the logging of new metrics.  
Please, open an issue, if you need it to be configurable: [https://github.com/elastic/beats/issues/new](https://github.com/elastic/beats/issues/new)

---

<div class="post-metadata">

**Author:** ![Warren\_Turner](https://avatars.discourse-cdn.com/v4/letter/w/e9c0ed/32.png) [@Warren\_Turner](https://discuss.elastic.co/u/Warren_Turner)\
**Post date:** [February 7, 2018, 4:46pm UTC](https://discuss.elastic.co/t/filebeat-6-2-seems-to-be-monitoring-the-server-its-running-on/118865/3 "2018-02-07T16:46:10Z")

</div>

Thanks, a few questions.  
Is there documentation somewhere about this change?  
Why add this to filebeat when you have metricbeat for this exact purpose?  
Is it actually sending this information to my logstash servers?

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [February 7, 2018, 5:53pm UTC](https://discuss.elastic.co/t/filebeat-6-2-seems-to-be-monitoring-the-server-its-running-on/118865/4 "2018-02-07T17:53:26Z")

</div>

I haven't found documentation on it. But it's in the blogpost announcing 6.2 release and also in the release notes.

> **[Beats 6.2.0 released
	  	 | Elastic](https://www.elastic.co/blog/beats-6-2-0-released)**
>
> We’re pleased to announce the Beats 6.2.0 release, coming with plenty of new features including central monitoring, a passwords keystore, Auditbeat GA, Kubernetes autodiscovery, and a Filebeat module ...

  
[https://www.elastic.co/guide/en/beats/libbeat/6.2/release-notes-6.2.0.html](https://www.elastic.co/guide/en/beats/libbeat/6.2/release-notes-6.2.0.html)  
I have also seen docs on the topic in the repo, but I cannot find it on our website. I will edit this post if I find it in the meantime.

This is reported by all Beats, including Packetbeat, Auditbeat, Filebeat, Metricbeat and Winlogbeat. Other Elastic products were already reported similar metrics to X-Pack. Beats is catching up now. As you can see in the blogpost, the collected data is visualized in Kibana.

By default, it's only printed to the logs, as you pasted in your initial comment.  
If you add

```auto
xpack.monitoring.enabled: true

```

to you config monitoring events are sent to an Elasticsearch instance. Logstash does not receive this data, unless you send the log of Filebeat to Logstash.

Let me know if you need further information.

Edit: I found the documentation: [https://www.elastic.co/guide/en/beats/filebeat/current/monitoring.html](https://www.elastic.co/guide/en/beats/filebeat/current/monitoring.html)

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [February 7, 2018, 7:25pm UTC](https://discuss.elastic.co/t/filebeat-6-2-seems-to-be-monitoring-the-server-its-running-on/118865/5 "2018-02-07T19:25:16Z")

</div>

Logging non-zero metrics every 30s is no new feature, but has been in beats since 5.x. Only the format seems to have been changed from flattened names to json.

As these metrics are provided by the logging module, checkout the [logging.metrics.enabled](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-logging.html#_literal_logging_metrics_enabled_literal) setting.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 7, 2018, 7:25pm UTC](https://discuss.elastic.co/t/filebeat-6-2-seems-to-be-monitoring-the-server-its-running-on/118865/6 "2018-03-07T19:25:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
