Filebeat xpack.monitoring.elasticsearch.period?

The documentation is not clear


The time interval (in seconds) when metrics are sent to the Elasticsearch cluster. A new snapshot of Filebeat metrics is generated and scheduled for publishing each period. The default value is 60 * time.Second.

What should be the value, i tried this in filebeat.yml

xpack.monitoring.elasticsearch.hosts: ["", ""]
xpack.monitoring.elasticsearch.username: "${XMON)"
xpack.monitoring.elasticsearch.password: "${XPAS}"
xpack.monitoring.elasticsearch.compression_level: "1"
xpack.monitoring.elasticsearch.bulk_max_size: "100"
xpack.monitoring.elasticsearch.period: "60s" "/etc/filebeat/certificates/root-ca.pem"
xpack.monitoring.elasticsearch.ssl.verification_mode: "none"

I get this error in elasticsearch

[2018-03-13T11:18:03,396][DEBUG][r.suppressed] path: /_xpack/monitoring/_bulk, params: {system_id=beats, system_api_version=6, interval=1m0s}
org.elasticsearch.ElasticsearchParseException: failed to parse [1m0s]
at org.elasticsearch.common.unit.TimeValue.parse( ~[elasticsearch-6.2.2.jar:6.2.2]
at org.elasticsearch.common.unit.TimeValue.parseTimeValue( ~[elasticsearch-6.2.2.jar:6.2.2]


`xpack.monitoring.Elasticsearch.period: "60"

I'll raise an issue for improving the documentation also, thanks for bringing this up

Thanks @ikakavas, well does it have to be only in seconds ?

For 5 minutes do i have to set it as 300


This is actually a bug because of the difference in how filebeat parses the value and the formats the Elasticsearch supports. We have opened an issue for this, for now can you try

xpack.monitoring.elasticsearch.period: "59s"

as a quick workaround ?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.