# How do I modify collect specific processes and top 10 processes in metricbeat's system module?

**URL:** <https://discuss.elastic.co/t/how-do-i-modify-collect-specific-processes-and-top-10-processes-in-metricbeats-system-module/272364>\
**Category:** Elasticsearch\
**Created:** [May 7, 2021, 4:56am UTC](https://discuss.elastic.co/t/how-do-i-modify-collect-specific-processes-and-top-10-processes-in-metricbeats-system-module/272364 "2021-05-07T04:56:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jongpyo.lee](https://avatars.discourse-cdn.com/v4/letter/j/b38774/32.png) [@jongpyo.lee](https://discuss.elastic.co/u/jongpyo.lee)\
**Post date:** [May 7, 2021, 4:56am UTC](https://discuss.elastic.co/t/how-do-i-modify-collect-specific-processes-and-top-10-processes-in-metricbeats-system-module/272364/1 "2021-05-07T04:56:18Z")

</div>

I have a question when collecting data from the system module.

- When collecting processes, I would like to collect the top 10 CPU and memory information.
- When collecting processes, I want to collect a specific process.name. (Example: Notepad\*, xyz.exe)

How do I modify it in System.yml to create Visualize by collecting both collection targets together?

I modified it as below, but the data of the Top 10 process is not collected, only a specific process is collected.

```yml
## system.yml

# Module: system
# Docs: https://www.elastic.co/guide/en/beats/metricbeat/master/metricbeat-module-system.html

- module: system
  period: 30s
  metricsets:
    - cpu
    - memory
    - network
    - process
    - process_summary
    - socket_summary
    - diskio
    - filesystem
    - uptime
       # https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metricset-system-service.html
  cpu.metrics: [percentages, normalized_percentages]
  filesystem.ignore_types: [nsfs, nfs, smbfs, autofs]
  #processes: ['.*', 'Notepad*', 'vapm.exe', 'epmd*']
  processes: ['.*']
  processes: ['Notepad*', 'vapm.exe', 'epmd*']  
  process.include_top_n.by_cpu: 10
  process.include_top_n.by_memory: 10
  process.cgroups.enabled: false
  process.include_cpu_ticks: true
  filters:
    - drop_event.when.regexp:
      system.filesystem.mount_point: '^\/(sys|cgroup|proc|dev|etc|host)\/(.*)'
    - drop_event.when.regexp:
      system.filesystem.device_name: '^(sys|cgroup|proc|dev|etc|host|sysfs|gvfsd-fuse)'

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/c/ccd5a7c0817bfd0679b0f64d124e12827c7cbed6.png)

## Result

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/e/5ebd1d28050e40191dbdcdc0a236a23f2f6f9610.png)

How do I collect all top 10 process and specific process information?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 7, 2021, 5:18am UTC](https://discuss.elastic.co/t/how-do-i-modify-collect-specific-processes-and-top-10-processes-in-metricbeats-system-module/272364/2 "2021-05-07T05:18:04Z")

</div>

Hi @jongpyo.lee

Perhaps take a look at this [thread](https://discuss.elastic.co/t/metricbeat-doesnt-recognize-the-process/263176) it is very similar

In short you define 2 separate metricsets 1 to collect Top N one to collect individual processes.

---

<div class="post-metadata">

**Author:** ![jongpyo.lee](https://avatars.discourse-cdn.com/v4/letter/j/b38774/32.png) [@jongpyo.lee](https://discuss.elastic.co/u/jongpyo.lee)\
**Post date:** [May 7, 2021, 7:01am UTC](https://discuss.elastic.co/t/how-do-i-modify-collect-specific-processes-and-top-10-processes-in-metricbeats-system-module/272364/3 "2021-05-07T07:01:51Z")

</div>

Hi, @stephenb

It's very awesome.  
Thank you very much. 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 4, 2021, 7:02am UTC](https://discuss.elastic.co/t/how-do-i-modify-collect-specific-processes-and-top-10-processes-in-metricbeats-system-module/272364/4 "2021-06-04T07:02:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.