I have installed the system integration. This is generating info about different "drives" in my devices. Unfortunately "A:" and "D:" are generating a lot of log errors as they are kind of "removable" devices.
I found an article about how to avoid this by setting "filesystem.ignore_types" parameter.
But - where is the location for this? Is it "metricbeat.yml"?
I wonder as this config is `stored below a dedicated version of the agent (agent-8-6-2 ...)
Shouldn't it be possible to configure this at a central place so it is still available after an agent upgrade.
Yes - i am new to elastic but still searching here and with google could not answer me the question. Any help?
Hi @GKre,
If you can use an ingest pipeline you should be able to drop the events based upon a given criteria.
Thank you wave,
I'd prefer a solution where these events will not be created.
Filtering them on the server might be an option. My goal is to disable this monitor on devices where it will never be able to get usable results.
Is there an option to use the documented "filesystem.ignore_types"?
That makes sense. Do you have an example of what the undesired data after it has been ingested? That might give you the values you need for the "filesystem.ignore_types"
just give me some time - i'm on a trip...
No rush, take all the time you need.
here's an example for Drive D: which is a virtual CD drive, not connected. Same with A; that is available as device but never containing a "disk".
I want to find a way to exclude this messages to bel collected as long as there's not a valid files system recognized.
{
"_index": ".ds-logs-elastic_agent.metricbeat-default-2023.11.09-000012",
"_id": "wM7014sBtVG8T3DshALn",
"_version": 1,
"_score": 0,
"_source": {
"agent": {
"name": "igk-01",
"id": "862fb214-2ba5-405c-a92c-3af2c56477d8",
"type": "filebeat",
"ephemeral_id": "4cb75bbb-695c-4999-ae86-ddb469a88539",
"version": "8.10.4"
},
"service.name": "metricbeat",
"log": {
"file": {
"path": "C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-a92ca3\\logs\\elastic-agent-20231116.ndjson",
"vol": 2557107097,
"idxlo": 1423,
"idxhi": 39649280
},
"offset": 2412758,
"source": "system/metrics-default"
},
"elastic_agent": {
"id": "862fb214-2ba5-405c-a92c-3af2c56477d8",
"version": "8.10.4",
"snapshot": false
},
"message": "error getting filesystem usage for D:\\: GetDiskFreeSpaceEx failed: Das Gerät ist nicht bereit.",
"log.logger": "system.filesystem",
"input": {
"type": "filestream"
},
"log.origin": {
"file.line": 90,
"file.name": "filesystem/filesystem.go"
},
"component": {
"binary": "metricbeat",
"id": "system/metrics-default",
"type": "system/metrics",
"dataset": "elastic_agent.metricbeat"
},
"@timestamp": "2023-11-16T11:46:43.562Z",
"ecs": {
"version": "8.0.0"
},
"data_stream": {
"namespace": "default",
"type": "logs",
"dataset": "elastic_agent.metricbeat"
},
"host": {
"hostname": "igk-01",
"os": {
"build": "20348.2031",
"kernel": "10.0.20348.2031 (WinBuild.160101.0800)",
"name": "Windows Server 2022 Standard",
"family": "windows",
"type": "windows",
"version": "10.0",
"platform": "windows"
},
"ip": [
"fd77:ade4:e825::c",
"fd77:ade4:e825:0:20c:29ff:fe98:7110",
"fe80::20c:29ff:fe98:7110",
"192.168.0.12"
],
"name": "igk-01",
"id": "46562127-7021-44a0-9988-f00050e8b4dd",
"mac": [
"00-0C-29-98-71-10"
],
"architecture": "x86_64"
},
"log.level": "error",
"event": {
"agent_id_status": "verified",
"ingested": "2023-11-16T11:46:48Z",
"dataset": "elastic_agent.metricbeat"
}
},
"fields": {
"log.file.vol": [
2557107097
],
"elastic_agent.version": [
"8.10.4"
],
"component.binary": [
"metricbeat"
],
"host.os.name.text": [
"Windows Server 2022 Standard"
],
"host.hostname": [
"igk-01"
],
"host.mac": [
"00-0C-29-98-71-10"
],
"log.logger": [
"system.filesystem"
],
"host.os.build": [
"20348.2031"
],
"host.ip": [
"fd77:ade4:e825::c",
"fd77:ade4:e825:0:20c:29ff:fe98:7110",
"fe80::20c:29ff:fe98:7110",
"192.168.0.12"
],
"agent.type": [
"filebeat"
],
"component.id": [
"system/metrics-default"
],
"host.os.version": [
"10.0"
],
"host.os.kernel": [
"10.0.20348.2031 (WinBuild.160101.0800)"
],
"component.dataset": [
"elastic_agent.metricbeat"
],
"host.os.name": [
"Windows Server 2022 Standard"
],
"log.level": [
"error"
],
"agent.name": [
"igk-01"
],
"elastic_agent.snapshot": [
false
],
"host.name": [
"igk-01"
],
"event.agent_id_status": [
"verified"
],
"host.id": [
"46562127-7021-44a0-9988-f00050e8b4dd"
],
"log.origin.file.line": [
90
],
"service.name": [
"metricbeat"
],
"host.os.type": [
"windows"
],
"elastic_agent.id": [
"862fb214-2ba5-405c-a92c-3af2c56477d8"
],
"data_stream.namespace": [
"default"
],
"log.file.idxhi": [
39649280
],
"log.file.idxlo": [
1423
],
"log.source": [
"system/metrics-default"
],
"input.type": [
"filestream"
],
"log.offset": [
2412758
],
"message": [
"error getting filesystem usage for D:\\: GetDiskFreeSpaceEx failed: Das Gerät ist nicht bereit."
],
"data_stream.type": [
"logs"
],
"component.type": [
"system/metrics"
],
"host.architecture": [
"x86_64"
],
"event.ingested": [
"2023-11-16T11:46:48.000Z"
],
"@timestamp": [
"2023-11-16T11:46:43.562Z"
],
"log.origin.file.name": [
"filesystem/filesystem.go"
],
"agent.id": [
"862fb214-2ba5-405c-a92c-3af2c56477d8"
],
"ecs.version": [
"8.0.0"
],
"host.os.platform": [
"windows"
],
"data_stream.dataset": [
"elastic_agent.metricbeat"
],
"log.file.path": [
"C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-a92ca3\\logs\\elastic-agent-20231116.ndjson"
],
"agent.ephemeral_id": [
"4cb75bbb-695c-4999-ae86-ddb469a88539"
],
"agent.version": [
"8.10.4"
],
"host.os.family": [
"windows"
],
"event.dataset": [
"elastic_agent.metricbeat"
]
}
}
in addition to the above - the log entry is created every minute. If you multiply it with the number of systems and A:/D: as common devices this is generating a lot of "SPAM" and occupying storage without need.
Ok, so looks like the documentation talks about just your situation. Looks like "unknown" would probably do the trick. Here's the example from the docs:
metricbeat.modules:
- module: system
period: 30s
metricsets: ["filesystem"]
filesystem.ignore_types: [unavailable, unknown]
@Wave - thank you.
i wonder where the correct file is located?
/home/guenter/elastic-agent-8.6.2-linux-x86_64/data/elastic-agent-913c02/components/modules.d/system.yml
/opt/Elastic/Agent/data/elastic-agent-a92ca3/components/modules.d/system.yml
I'd guess id is the second one. The first is the setup directory.
But - i do deploy via fleet. Shouldn't a config for all clients be done there?
Here i do configure the client only?
Strange for me...
and looks different to me also:
- module: system
period: 1m
metricsets:
- filesystem
- fsstat
processors:
- drop_event.when.regexp:
system. filesystem.mount_point: '^/(sys|cgroup|proc|devletc|host|lib|snap)($I/)'
guess i see the problem.
I am not using metricsbeat but the system integration.
I found the docu for this integration but i can not find a hint on how to configure it?
I found the solution. If i edit the system integration there's an " Collect metrics from System instances" chapter and "Change defaults". Here i can configure "List of filesystem types to ignore". I filled it with "unavailable, unknown". Let's wait and see...
Seems not to work - still receiving these errors:
{
"_index": ".ds-logs-elastic_agent.metricbeat-default-2023.11.09-000012",
"_id": "HCrb5osBOFFfY86FT3rW",
"_version": 1,
"_score": 0,
"_source": {
"agent": {
"name": "igk-02",
"id": "b058a09f-20c4-4106-b000-eb0fe77f6b16",
"type": "filebeat",
"ephemeral_id": "23d4a6cd-6c4a-44c8-9169-4865225044e8",
"version": "8.10.4"
},
"service.name": "metricbeat",
"log": {
"file": {
"path": "C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-a92ca3\\logs\\elastic-agent-20231119.ndjson",
"vol": 2659468882,
"idxlo": 1508,
"idxhi": 176881664
},
"offset": 5823822,
"source": "system/metrics-default"
},
"elastic_agent": {
"id": "b058a09f-20c4-4106-b000-eb0fe77f6b16",
"version": "8.10.4",
"snapshot": false
},
"message": "error getting filesystem usage for A:\\: GetDiskFreeSpaceEx failed: Das Gerät ist nicht bereit.",
"log.logger": "system.filesystem",
"log.origin": {
"file.line": 90,
"file.name": "filesystem/filesystem.go"
},
"input": {
"type": "filestream"
},
"component": {
"binary": "metricbeat",
"id": "system/metrics-default",
"type": "system/metrics",
"dataset": "elastic_agent.metricbeat"
},
"@timestamp": "2023-11-19T09:13:28.865Z",
"ecs": {
"version": "8.0.0"
},
"data_stream": {
"namespace": "default",
"type": "logs",
"dataset": "elastic_agent.metricbeat"
},
"host": {
"hostname": "igk-02",
"os": {
"build": "20348.2113",
"kernel": "10.0.20348.2110 (WinBuild.160101.0800)",
"name": "Windows Server 2022 Standard",
"type": "windows",
"family": "windows",
"version": "10.0",
"platform": "windows"
},
"ip": [
"fd77:ade4:e825::6",
"fd77:ade4:e825:0:ff98:1581:a500:f66c",
"fe80::da95:f849:4b4:89dd",
"192.168.0.6",
"fe80::9994:5caf:2237:381d",
"172.25.16.1"
],
"name": "igk-02",
"id": "f39f0b59-62c0-42aa-8603-b612cd8074b6",
"mac": [
"00-0C-29-73-7F-90",
"00-15-5D-06-FB-DF"
],
"architecture": "x86_64"
},
"log.level": "error",
"event": {
"agent_id_status": "verified",
"ingested": "2023-11-19T09:13:34Z",
"dataset": "elastic_agent.metricbeat"
}
},
"fields": {
"log.file.vol": [
2659468882
],
"elastic_agent.version": [
"8.10.4"
],
"component.binary": [
"metricbeat"
],
"host.os.name.text": [
"Windows Server 2022 Standard"
],
"host.hostname": [
"igk-02"
],
"host.mac": [
"00-0C-29-73-7F-90",
"00-15-5D-06-FB-DF"
],
"log.logger": [
"system.filesystem"
],
"host.os.build": [
"20348.2113"
],
"host.ip": [
"fd77:ade4:e825::6",
"fd77:ade4:e825:0:ff98:1581:a500:f66c",
"fe80::da95:f849:4b4:89dd",
"192.168.0.6",
"fe80::9994:5caf:2237:381d",
"172.25.16.1"
],
"agent.type": [
"filebeat"
],
"component.id": [
"system/metrics-default"
],
"host.os.version": [
"10.0"
],
"host.os.kernel": [
"10.0.20348.2110 (WinBuild.160101.0800)"
],
"component.dataset": [
"elastic_agent.metricbeat"
],
"host.os.name": [
"Windows Server 2022 Standard"
],
"log.level": [
"error"
],
"agent.name": [
"igk-02"
],
"elastic_agent.snapshot": [
false
],
"host.name": [
"igk-02"
],
"event.agent_id_status": [
"verified"
],
"host.id": [
"f39f0b59-62c0-42aa-8603-b612cd8074b6"
],
"log.origin.file.line": [
90
],
"service.name": [
"metricbeat"
],
"host.os.type": [
"windows"
],
"elastic_agent.id": [
"b058a09f-20c4-4106-b000-eb0fe77f6b16"
],
"data_stream.namespace": [
"default"
],
"log.file.idxhi": [
176881664
],
"log.file.idxlo": [
1508
],
"log.source": [
"system/metrics-default"
],
"input.type": [
"filestream"
],
"log.offset": [
5823822
],
"message": [
"error getting filesystem usage for A:\\: GetDiskFreeSpaceEx failed: Das Gerät ist nicht bereit."
],
"data_stream.type": [
"logs"
],
"component.type": [
"system/metrics"
],
"host.architecture": [
"x86_64"
],
"event.ingested": [
"2023-11-19T09:13:34.000Z"
],
"@timestamp": [
"2023-11-19T09:13:28.865Z"
],
"log.origin.file.name": [
"filesystem/filesystem.go"
],
"agent.id": [
"b058a09f-20c4-4106-b000-eb0fe77f6b16"
],
"ecs.version": [
"8.0.0"
],
"host.os.platform": [
"windows"
],
"data_stream.dataset": [
"elastic_agent.metricbeat"
],
"log.file.path": [
"C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-a92ca3\\logs\\elastic-agent-20231119.ndjson"
],
"agent.ephemeral_id": [
"23d4a6cd-6c4a-44c8-9169-4865225044e8"
],
"agent.version": [
"8.10.4"
],
"host.os.family": [
"windows"
],
"event.dataset": [
"elastic_agent.metricbeat"
]
}
}
Can you share your latest configuration for the system module?
i'd like to but can not find something to export?
here's the screenshot of the relevan setting - the only one i changed.
Can you try adding them each on their own line? Clicking the "Add row" should let you do that.
i changed it into two lines - ssems not to make the change.
Hi -
Any follow up on this topic please ?
I am facing the same issue and the only temporary solution that works is to disable filesystem metrics option..
Are you configuring this through kibana or though the configuration file? If you could provide how you have it configured that might help figure out what is going on.