It is not possible exclude specific mount point from metricbeat measurement

Elastic Stack Beats
1

I use metricbeat on linux server to detect free disk space on disk.

My metricbeat.yml is set like this:

processors:
    -drop_event.when.regexp:
       system.filesystem.mount_point: ‘^ / (sys | cgroup | proc | run | netns | dev | etc | host | lib) ($ | /) ′
  enabled: true
  period: 1h
  filesystem.ignore_types: [tmpfs, sysfs, proc, devtmpfs, devpts, nsfs, securityfs, cgroup2, pstore, bpf]

even so I receive in metricbeat-index, record with these properties:

    "system.filesystem.mount_point": [
      "/run/netns/cni-326c03fa-5399-1cd4-7b30-6d30099cca9b"
    ],
    "system.filesystem.device_name": [
      "nsfs"
    ],
    "system.filesystem.free": [
      0
    ],

How can I really exclude these mounts:

nsfs on /run/netns/cni-326c03fa-5399-1cd4-7b30-6d30099cca9b type nsfs (rw)
nsfs on /run/netns/cni-81b49f4e-d09f-7a4d-5a30-005ab7ecdf8a type nsfs (rw)
nsfs on /run/netns/cni-37acdf3f-4b01-e81a-a0ee-27e2bd5d9268 type nsfs (rw)

from measurement and let there only this wanted ext4 mount ?

/dev/sda3 on / type ext4 (rw,relatime,errors=remount-ro)

TY for any help or direction.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.