Filebeat xpack.monitoring.elasticsearch.period?

[pfseth (Santosh Hulkund)]

The documentation is not clear

period

The time interval (in seconds) when metrics are sent to the Elasticsearch cluster. A new snapshot of Filebeat metrics is generated and scheduled for publishing each period. The default value is 60 * time.Second.

What should be the value, i tried this in filebeat.yml

xpack.monitoring.elasticsearch.hosts: ["https://esa1-ir.com:9200", "https://esa2-ir.com:9200"]
xpack.monitoring.elasticsearch.username: "${XMON)"
xpack.monitoring.elasticsearch.password: "${XPAS}"
xpack.monitoring.elasticsearch.compression_level: "1"
xpack.monitoring.elasticsearch.bulk_max_size: "100"
xpack.monitoring.elasticsearch.period: "60s"
xpack.monitoring.elasticsearch.ssl.ca: "/etc/filebeat/certificates/root-ca.pem"
xpack.monitoring.elasticsearch.ssl.verification_mode: "none"

I get this error in elasticsearch

[2018-03-13T11:18:03,396][DEBUG][r.suppressed] path: /_xpack/monitoring/_bulk, params: {system_id=beats, system_api_version=6, interval=1m0s}
org.elasticsearch.ElasticsearchParseException: failed to parse [1m0s]
at org.elasticsearch.common.unit.TimeValue.parse(TimeValue.java:365) ~[elasticsearch-6.2.2.jar:6.2.2]
at org.elasticsearch.common.unit.TimeValue.parseTimeValue(TimeValue.java:335) ~[elasticsearch-6.2.2.jar:6.2.2]

[ikakavas (Ioannis Kakavas)]

@pfseth

xpack.monitoring.elasticsearch.period: "60s"

Try

`xpack.monitoring.elasticsearch.period: "60"

I'll raise an issue for improving the documentation also, thanks for bringing this up

[pfseth (Santosh Hulkund)]

Thanks @ikakavas, well does it have to be only in seconds ?

For 5 minutes do i have to set it as 300

[ikakavas (Ioannis Kakavas)]

Hi,

This is actually a bug because of the difference in how filebeat parses the value and the formats the Elasticsearch supports. We have opened an issue for this, for now can you try

xpack.monitoring.elasticsearch.period: "59s"

as a quick workaround ?