Group multiple metric to one event

Hi all,

I'm using metricbeat to collect some instance metrics with system module. When I set cpu, memory and network in the metricsets, I found that metricbeat actually emit three lines of log repestively. Can I merge these events into one because my monitor service is expecting a log with all these metrics like "{"cpu":"27","memory":"1234m","network":"50"}".


I'm afraid that you can't merge them

Or can I split a event to multiple line? Since I can not aggregate them, I may want to totally separate the metrics.
For example a system.cpu metricset returns both cpu usage and cpu idle, then I'd like to have two logs respectively. Will script processor help?

What monitor service do you use?

It's possible to group(merge) all metrics on elastic side using a transform, that means you would index metricbeat data as is and have a transform which queries that index and writes a secondary index, which transforms the data into the format you want. It's advised to use at least 7.7.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.