I am getting the filebeat data where i am supposed to get only metricbeat data.
here is my code, what i am missing or what are the ways i can debug and find the issue ?
metricbeat.yml:
metricbeat.modules:
- module: system
metricsets:
- cpu
- load
- core
- diskio
- filesystem
- fsstat
- memory
- network
- process
enabled: true
period: 10s
processes: ['.*']
output.logstash:
hosts: ["logstash-server.domain:5044"]
logging.level: warning
logstash-metric.conf:
input {
beats {
port => 5044
}
}
filter {
if [@metadata][beat] == "metricbeat" {
grok {
match => { "[system][process][cmdline]" => "[(?<projectdate>java -jar\s)(?<projectenv>([-]?Denv[=]?[prdeval]+[23]?\s))(?<projecttype>([-]?Dtype[=]?[a-zA-Z0-9-]+\s))(?<projectapp>([-]?Dapp[=]?[project23]+\s))(?<prof>([a-zA-Z0-9=-]+\s))(?<springprofile>([.a-zA-Z0-9=-]+\s))(?<servicename>([a-zA-Z0-9=-]+\s))(?<appserver>([.a-zA-Z0-9=-]+\s))(%{GREEDYDATA:rest})]" }
add_field => { "service_status" => "running" }
}
}
}
output {
elasticsearch {
hosts => ["elasticsearch-server.domain:9200"]
manage_template => false
index => "metric-microservice-%{+YYYY.MM.dd}"
}
}
I need to match only similar java processes and other processes only and not Filebeat data:
{
"_index": "metric-microservice-2018.03.05",
"_type": "metricsets",
"_id": "AWH2k5q0OJtEtYrhjgpL",
"_score": null,
"_source": {
"system": {
"process": {
"memory": {
"rss": {
"pct": 0.011,
"bytes": 742027264
},
"size": 4006264832,
"share": 11497472
},
"cmdline": "java -jar -Denv=ver -Dtype=3-0 -Dapp=project3 -Dprof=ver-3-0 -Dspring.profiles.active=env-3-0 -Dsvcname=project-component-3-0 -Dhostname=my-build-server.project.adml -Dsecname=my-build-server.fullname -Dapachsvr_port=8090 -Dprotocol=https -Dssl_enabled=true -Xms128m -Xmx256m -DLOG_PATH=/var/opt/logs -Dlog_path=/var/opt/logs /var/opt/pivotal/svcs/project-component.jar /tmp",
"pgid": 18546,
"name": "java",
"cpu": {
"start_time": "2018-02-20T16:53:40.000Z",
"total": {
"pct": 0
}
},
"pid": 19615,
"state": "sleeping",
"fd": {
"limit": {
"hard": 4096,
"soft": 4096
},
"open": 46
},
"ppid": 1,
"username": "root"
}
},
"@timestamp": "2018-03-05T14:32:03.089Z",
"beat": {
"hostname": "my-build-server",
"name": "my-build-server",
"version": "5.0.1"
},
"@version": "1",
"host": "my-build-server",
"service_status": "running",
"metricset": {
"rtt": 84209,
"module": "system",
"name": "process"
},
"type": "metricsets",
"tags": [
"beats_input_raw_event"
]
},
"fields": {
"@timestamp": [
1520260323089
]
},
"sort": [
1520260323089
]
}
?
