Is there any way to exclude Windows Drive on the metricbeat configuration?

Elastic Stack Beats
1

Hello everyone,

I have some Windows Servers that have SWAP (pagefile.sys) configured and located in a small disk. As this is a "Standard Configuration" there are lot of events related to this as the disk is almost full all the time. Is there any way to exclude the Drive D: from the metricbeat?

On Linux there is an option to drop any event when a regular expression match for the filesystem mountpoints:

  - drop_event.when.regexp:
      system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|host|lib)($|/)'

Is there any similar configuration for Windows to exclude the Drive D:?

Thank you!
Gus

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.