Hi,
I am running the Filebeat deb package on Ubuntu Server 20.04. I noticed that when I set logging.metrics.enabled: false Filebeat still writes monitoring messages to syslog and then forwards them when I have the system module enabled. I have no use for these metrics and they tend to be noisier than other log sources from the server in question. I can certainly filter them out when reviewing logs, but I would rather never log them as they serve no purpose for me. For example:
2021-01-14T22:47:31.870-0500#011INFO#011[monitoring]#011log/log.go:145#011Non-zero metrics in the last 30s#011{"monitoring": {"metrics": {"auditd":{"received_msgs":2},"beat":{"cgroup":{"cpuacct":{"total":{"ns":336806127}},"memory":{"mem":{"usage":{"bytes":-217088}}}},"cpu":{"system":{"ticks":18730,"time":{"ms":133}},"total":{"ticks":43710,"time":{"ms":337},"value":43710},"user":{"ticks":24980,"time":{"ms":204}}},"handles":{"limit":{"hard":524288,"soft":1024},"open":113},"info":{"ephemeral_id":"54d4938d-3598-4da7-a5e5-25b3b5cc2cef","uptime":{"ms":2747519}},"memstats":{"gc_next":14923696,"memory_alloc":9702768,"memory_total":1821715256,"rss":20480},"runtime":{"goroutines":66}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":2,"batches":2,"failed":2,"total":4},"read":{"bytes":1856},"write":{"bytes":2859,"errors":2}},"pipeline":{"clients":8,"events":{"active":0,"published":2,"retry":4,"total":2},"queue":{"acked":2}}},"metricbeat":{"auditd":{"auditd":{"events":2,"success":2}}},"system":{"load":{"1":0.06,"15":0.11,"5":0.04,"norm":{"1":0.015,"15":0.0275,"5":0.01}}}}}}
My Logging config is below. Filebeat otherwise works just fine. Am I misunderstanding the documentation here?
#================================ Logging =====================================
# Sets log level. The default log level is info.
# Available log levels are: error, warning, info, debug
logging.level: warning
# At debug level, you can selectively enable logging only for some components.
# To enable all selectors use ["*"]. Examples of other selectors are "beat",
# "publish", "service".
#logging.selectors: ["*"]
# Disable Logging
logging.metrics.enabled: false
logging.metrics.period: 300s
I also tried to set the metric to 5 minutes. This also appears to have no effect as Filebeat still writes metrics to syslog every 30 seconds.