# Filebeat Stats and Metrics

**URL:** <https://discuss.elastic.co/t/filebeat-stats-and-metrics/227408>\
**Category:** Beats\
**Tags:** elastic-stack-monitoring, elastic-stack-alerting, filebeat\
**Created:** [April 9, 2020, 9:34pm UTC](https://discuss.elastic.co/t/filebeat-stats-and-metrics/227408 "2020-04-09T21:34:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Emily\_Hontoria](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emily_hontoria/32/66037_2.png) [@Emily\_Hontoria](https://discuss.elastic.co/u/Emily_Hontoria)\
**Post date:** [April 9, 2020, 9:34pm UTC](https://discuss.elastic.co/t/filebeat-stats-and-metrics/227408/1 "2020-04-09T21:34:48Z")

</div>

Hi folks, I am trying to better understand the metrics I am currently seeing from the filebeat /stats call.

Specifically looking to understand exactly what these metrics are:

```
    u'filebeat': {u'events': {u'active': 12, u'added': 571, u'done': 559},
    u'libbeat':
                u'output': {u'events': {u'acked': 516,
                                       u'active': 0,
                                        u'batches': 54,
                                        u'dropped': 0,
                                        u'duplicates': 0,
                                        u'failed': 0,
                                        u'total': 516},
                u'read': {u'bytes': 324, u'errors': 0},
                              u'type': u'logstash',
                              u'write': {u'bytes': 98123, u'errors': 0}},
                 u'pipeline': {u'clients': 1,
                              u'events': {u'active': 12,
                                                 u'dropped': 0,
                                                 u'failed': 0,
                                                 u'filtered': 43,
                                                 u'published': 528,
                                                 u'retry': 288,
                                                 u'total': 571},
                              u'queue': {u'acked': 516}}}

```

I trimmed down to just the sections I really care about.

- What do the "dropped" metrics mean?
- What do the "output" and the "pipeline" mean?
- What exactly is an "event"?
- What is the difference between a filebeat "event" and a libbeat "event"? The two sets of numbers are different and I'm not quite sure why

In addition to those questions, if I could get definitions for the different stats that would be great!

---

<div class="post-metadata">

**Author:** ![Luca\_Belluccini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luca_belluccini/32/33239_2.png) [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)\
**Post date:** [April 9, 2020, 11:16pm UTC](https://discuss.elastic.co/t/filebeat-stats-and-metrics/227408/2 "2020-04-09T23:16:14Z")

</div>

Hello @Emily_Hontoria

I am not a Beat developer so the provided information might not be accurate.

> [@Emily\_Hontoria](#):
>
> What do the "dropped" metrics mean?

I think this post might explain the `dropped` meaning: [Safely publish an event using libbeat - #3 by steffens](https://discuss.elastic.co/t/safely-publish-an-event-using-libbeat/52395/3)

An example of an event dropped in `libbeat` `output` is a document which is malformed (e.g. bad encoding) when being sent to a final destination (e.g. Elasticsearch).  
An example of an event dropped in `libbeat` `pipeline` is a document which is excluded (e.g. [`exclude_lines`](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-exclude-lines) in `log` input or [`drop_event`](https://www.elastic.co/guide/en/beats/filebeat/current/drop-event.html) processor.

We document those fields:

- In [GoDoc](https://godoc.org/github.com/elastic/beats/libbeat/outputs)
- The exported fields when monitoring Filebeat using Metricbeat Filebeat module ([doc](https://www.elastic.co/guide/en/beats/metricbeat/current/exported-fields-beat.html))

> [@Emily\_Hontoria](#):
>
> What do the "output" and the "pipeline" mean?

I think:

- the output stats are related to the declared output in the configuration (e.g. Beats are able to send to different destinations)
- the pipeline stats are related to the declared processors, filters, conditionals and the internal queue

We document those fields in [GoDoc](https://godoc.org/github.com/elastic/beats/libbeat/publisher/pipeline#Pipeline).

> [@Emily\_Hontoria](#):
>
> What is the difference between a filebeat "event" and a libbeat "event"?

I think the difference is the following:

- a `filebeat` event is an event with specific fields, respecting the `filebeat` definition of event (e.g. a `filebeat` event coming from `syslog tcp` input with its dedicated fields or from a `log` input), built on top of a `libbeat` event
- a `libbeat` event is the common event format shared by all beats. Every event must have a timestamp and provide encodable Fields in `Fields`

* * *

In any case, those metrics are meant to be digested by the Elastic Stack Monitoring tools (see [here](https://www.elastic.co/guide/en/beats/filebeat/current/monitoring.html)).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 7, 2020, 11:18pm UTC](https://discuss.elastic.co/t/filebeat-stats-and-metrics/227408/3 "2020-05-07T23:18:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.