# How can I make collectd report which device/mount point it is looking at? **URL:** \ **Category:** Logstash\ **Created:** [October 21, 2015, 10:43pm UTC](https://discuss.elastic.co/t/how-can-i-make-collectd-report-which-device-mount-point-it-is-looking-at/32728 "2015-10-21T22:43:59Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![jerrac](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jerrac/32/52980_2.png) [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Post date:** [October 21, 2015, 10:43pm UTC](https://discuss.elastic.co/t/how-can-i-make-collectd-report-which-device-mount-point-it-is-looking-at/32728/1 "2015-10-21T22:43:59Z")
Using collectd i want to report disk space usage to ELK. I successfully enabled CollectD's df plugin, and it is sending data to ELK. But I don't see any field that says "this is the usage for /boot", or "this is the usage for /home", or any other mountpoint I tell collectd to monitor. I collectd only able to report total disk space usage? I was trying something like: ``` MountPoint "/boot" MountPoint "/" ``` ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [October 21, 2015, 11:43pm UTC](https://discuss.elastic.co/t/how-can-i-make-collectd-report-which-device-mount-point-it-is-looking-at/32728/2 "2015-10-21T23:43:29Z")
It should automatically do that. The resulting fields in Logstash will be "plugin\_instance" (which will show the mount point), "type\_instance" (e.g. free, used, reserved), and the associated "value." For example, my Kibana query: ``` type.raw:"collectd" AND plugin.raw:"df" AND plugin_instance.raw:"root" ``` And an individual "log line" from the Discover panel: ``` plugin:df plugin_instance:root type:collectd tags:collectd host:blackbox.REDACTED.net @timestamp:October 21st 2015, 17:37:48.159 type_instance:free collectd_type:df_complex value:846,273,490,944 @version:1 _id:AVCMxAX_4IhnevJIINXz _type:collectd _index:logstash-2015.10.21 ``` ---
**Author:** ![jerrac](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jerrac/32/52980_2.png) [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Post date:** [October 22, 2015, 6:12pm UTC](https://discuss.elastic.co/t/how-can-i-make-collectd-report-which-device-mount-point-it-is-looking-at/32728/3 "2015-10-22T18:12:56Z")
And now I see that field... I swear I didn't see it before... _sigh_ Thanks. ๐Ÿ˜„ ---
**Author:** ![jerrac](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jerrac/32/52980_2.png) [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Post date:** [October 23, 2015, 11:23pm UTC](https://discuss.elastic.co/t/how-can-i-make-collectd-report-which-device-mount-point-it-is-looking-at/32728/4 "2015-10-23T23:23:08Z")
Hmm... I'm having issues graphing the data in a useful manner. df is giving me several values for type\_instance. root, boot, reserved, used, and free. If it's root or boot, I get two fields called used and free. If it's reserved, used, or free, I get one field called value. And, after some research while writing this post, I figured out that the difference is because of different collectd versions. Ubuntu 12.04 has 4.10.1, and Ubuntu 14.04 has 5.4.0. CollectD 4.10.1 has the data with the used and free fields. ``` "_source": { "host": "hostname", "@timestamp": "2015-10-23T23:05:14.000Z", "type_instance": "root", "plugin": "df", "collectd_type": "df", "used": 5152854016, "free": 14655479808, "@version": "1", "type": "collectd" }, ``` 5.4.0 has the data with the value field. ``` "_source": { "host": "hostname2", "@timestamp": "2015-10-23T23:05:08.225Z", "type_instance": "free", "plugin": "df", "plugin_instance": "boot", "collectd_type": "df_complex", "value": 58056704, "@version": "1", "type": "collectd" }, ``` So how do I build a decent visualization? I'd like a split line graph that shows the max values for free and used. That's easy to do with data from 4.10. But how do I add in the data from 5.4? It's a separate doc for each free or used value... I could do a version specific visualization for 5.4, but that's rather clunky. Is there a way to use the scripting feature to do this? Any thoughts? ---
**Author:** ![jerrac](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jerrac/32/52980_2.png) [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Post date:** [October 23, 2015, 11:44pm UTC](https://discuss.elastic.co/t/how-can-i-make-collectd-report-which-device-mount-point-it-is-looking-at/32728/5 "2015-10-23T23:44:53Z")
If I share this: ``` https://kibana.host.tld/#/visualize/edit/Used-and-Free-Disk-Space-Split-Lines?_g=%28%29&_a=%28filters:!%28%29,linked:!f,query:%28query_string:%28analyze_wildcard:!t,query:%27type.raw:%22collectd%22%20AND%20plugin.raw:%22df%22%20AND%20%28plugin_instance.raw:%22root%22%20OR%20type_instance.raw:%22root%22%29%27%29%29,vis:%28aggs:!%28%28id:%271%27,params:%28field:value%29,schema:metric,type:max%29,%28id:%272%27,params:%28customInterval:%272h%27,extended_bounds:%28%29,field:%27@timestamp%27,interval:auto,min_doc_count:1%29,schema:segment,type:date_histogram%29,%28id:%273%27,params:%28filters:!%28%28input:%28query:%28query_string:%28analyze_wildcard:!t,query:%27type_instance.raw:%22free%22%20OR%20plugin_instance.raw:%22free%22%27%29%29%29,label:%27%27%29,%28input:%28query:%28query_string:%28analyze_wildcard:!t,query:%27type_instance.raw:%22used%22%20OR%20plugin_instance.raw:%22used%22%27%29%29%29%29%29%29,schema:group,type:filters%29,%28id:%274%27,params:%28field:used%29,schema:metric,type:max%29,%28id:%275%27,params:%28field:free%29,schema:metric,type:max%29%29,listeners:%28%29,params:%28addLegend:!t,addTimeMarker:!f,addTooltip:!t,defaultYExtents:!f,drawLinesBetweenPoints:!t,interpolate:linear,radiusRatio:9,scale:linear,setYExtents:!f,shareYAxis:!t,showCircles:!t,smoothLines:!f,times:!%28%29,yAxis:%28%29%29,type:line%29%29 ``` Can you figure out the Kibana 4 settings I've tried? Since taking a screenshot doesn't capture all of the settings on the Visualization tab. ---
**Author:** ![mfournier](https://avatars.discourse-cdn.com/v4/letter/m/d78d45/32.png) [@mfournier](https://discuss.elastic.co/u/mfournier)\ **Post date:** [October 26, 2015, 7:53am UTC](https://discuss.elastic.co/t/how-can-i-make-collectd-report-which-device-mount-point-it-is-looking-at/32728/6 "2015-10-26T07:53:04Z")
collectd has a "target\_v5upgrade" plugin which helps converting v4 metrics to v5 format. See [https://collectd.org/wiki/index.php/V4\_to\_v5\_migration\_guide](https://collectd.org/wiki/index.php/V4_to_v5_migration_guide). Other than that, the collectd version shipped with 12.04 is really old and riddled with bugs. My advice would be to upgrade to the latest release: [https://launchpad.net/~collectd/+archive/ubuntu/collectd-5.5](https://launchpad.net/~collectd/+archive/ubuntu/collectd-5.5) Sure ES/kibana can do a lot of things, but everything is much easier when the input data is nice and consistent ๐Ÿ˜‰ My 2ยข ---
**Author:** ![jerrac](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jerrac/32/52980_2.png) [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Post date:** [October 26, 2015, 5:47pm UTC](https://discuss.elastic.co/t/how-can-i-make-collectd-report-which-device-mount-point-it-is-looking-at/32728/7 "2015-10-26T17:47:46Z")
Agreed. Hadn't looked for a good ppa yet. Thanks. Know of a good repo for CentOS 6? I haven't found one yet. ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [October 26, 2015, 7:49pm UTC](https://discuss.elastic.co/t/how-can-i-make-collectd-report-which-device-mount-point-it-is-looking-at/32728/8 "2015-10-26T19:49:44Z")
Unfortunately, no. I get a `Could not locate that visualization (id: Used-and-Free-Disk-Space-Split-Lines)` error. ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [October 26, 2015, 7:53pm UTC](https://discuss.elastic.co/t/how-can-i-make-collectd-report-which-device-mount-point-it-is-looking-at/32728/9 "2015-10-26T19:53:35Z")
I start with this: **Visualize tab:** Query bar: `type.raw:"collectd" AND plugin.raw:"df" AND plugin_instance.raw:"root"` ![](https://us1.discourse-cdn.com/elastic/original/2X/9/946699c2b9acd046d459a7e0a599e6cdbdc4f03e.png) I get a pie chart here with the slices being the amounts used by the root device. ---
**Author:** ![shrwn](https://avatars.discourse-cdn.com/v4/letter/s/e56c9b/32.png) [@shrwn](https://discuss.elastic.co/u/shrwn)\ **Post date:** [May 30, 2017, 10:04am UTC](https://discuss.elastic.co/t/how-can-i-make-collectd-report-which-device-mount-point-it-is-looking-at/32728/10 "2017-05-30T10:04:20Z")
Hi Jerrac, i am also facing this issue. I am able to get data in logstash logs and on stdout but as mentioned by @theuntergeek, new fields are not visible on GraylogUI. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:26am UTC](https://discuss.elastic.co/t/how-can-i-make-collectd-report-which-device-mount-point-it-is-looking-at/32728/11 "2017-07-06T04:26:14Z")