# Metricbeat 7.0.1 system.filesystem.ignore\_types not working correctly **URL:** \ **Category:** Beats\ **Tags:** metricbeat\ **Created:** [June 26, 2019, 1:01pm UTC](https://discuss.elastic.co/t/metricbeat-7-0-1-system-filesystem-ignore-types-not-working-correctly/187572 "2019-06-26T13:01:23Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![miksonx](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miksonx/32/129732_2.png) [@miksonx](https://discuss.elastic.co/u/miksonx)\ **Post date:** [June 26, 2019, 1:01pm UTC](https://discuss.elastic.co/t/metricbeat-7-0-1-system-filesystem-ignore-types-not-working-correctly/187572/1 "2019-06-26T13:01:23Z")
Hi, I have setup metricbeats to elastic to collect metrics from host filesystem running under openshift kubernetes pod Seems that the filesystem.ignore\_types only collect random or latest in the list of the file system - module: system period: 1m metricsets: - filesystem - fsstat filesystem.ignore\_types: [sysfs, proc, devtmpfs, securityfs, tmpfs, devpts, cgroup, pstore, configfs, systemd-1, hugetlbfs, mqueue, debugfs, binfmt\_misc, sunrpc] ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/7/7777348cfe97f8be28470648b14c300aa5f748d6.png) Tried with processors: - drop\_event.when.regexp: system.filesystem.mount\_point: '^/(sys|cgroup|proc|dev|devtmpfs|tmpfs|etc|host|lib)($|/)' but this only provide one latest docker mapped device. Running cat /etc/mtab on the host sysfs /sys sysfs rw,seclabel,nosuid,nodev,noexec,relatime 0 0 proc /proc proc rw,nosuid,nodev,noexec,relatime 0 0 devtmpfs /dev devtmpfs rw,seclabel,nosuid,size=16360424k,nr\_inodes=4090106,mode=755 0 0 securityfs /sys/kernel/security securityfs rw,nosuid,nodev,noexec,relatime 0 0 tmpfs /dev/shm tmpfs rw,seclabel,nosuid,nodev 0 0 devpts /dev/pts devpts rw,seclabel,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000 0 0 tmpfs /run tmpfs rw,seclabel,nosuid,nodev,mode=755 0 0 tmpfs /sys/fs/cgroup tmpfs ro,seclabel,nosuid,nodev,noexec,mode=755 0 0 systemd-1 /proc/sys/fs/binfmt\_misc autofs rw,relatime,fd=32,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe\_ino=23485 0 0 hugetlbfs /dev/hugepages hugetlbfs rw,seclabel,relatime 0 0 debugfs /sys/kernel/debug debugfs rw,relatime 0 0 nfsd /proc/fs/nfsd nfsd rw,relatime 0 0 /dev/sda2 /boot xfs rw,seclabel,relatime,attr2,inode64,noquota 0 0 /dev/sda1 /boot/efi vfat rw,relatime,fmask=0077,dmask=0077,codepage=437,iocharset=ascii,shortname=winnt,errors=remount-ro 0 0 /dev/mapper/nfs-pv\_data /opt/pv xfs rw,seclabel,relatime,attr2,inode64,noquota 0 0 /dev/mapper/rhel-home /home xfs rw,seclabel,relatime,attr2,inode64,noquota 0 0 sunrpc /var/lib/nfs/rpc\_pipefs rpc\_pipefs rw,relatime 0 0 /dev/mapper/rhel-root /var/lib/docker/containers xfs rw,seclabel,relatime,attr2,inode64,noquota 0 0 /dev/mapper/rhel-root /var/lib/docker/devicemapper xfs rw,seclabel,relatime,attr2,inode64,noquota 0 0 and running cat /etc/mtab inside metricbeat container rootfs / rootfs rw 0 0 /dev/mapper/docker-253:0-67491179-0cca744e6c7c134ceb5d4f42378640acbe1788d8bffbeab96eb12e25b037756a / xfs rw,context="system\_u:object\_r:container\_file\_t:s0:c270,c982",relatime,nouuid,attr2,inode64,sunit=1024,swidth=1024,noquota 0 0 sysfs /sys sysfs ro,seclabel,nosuid,nodev,noexec,relatime 0 0 tmpfs /sys/fs/cgroup tmpfs ro,context="system\_u:object\_r:container\_file\_t:s0:c270,c982",nosuid,nodev,noexec,relatime,mode=755 0 0 systemd-1 /hostfs/proc/sys/fs/binfmt\_misc autofs rw,relatime,fd=32,pgrp=0,timeout=0,minproto=5,maxproto=5,direct,pipe\_ino=23485 0 0 binfmt\_misc /hostfs/proc/sys/fs/binfmt\_misc binfmt\_misc rw,relatime 0 0 nfsd /hostfs/proc/fs/nfsd nfsd rw,relatime 0 0 /dev/mapper/rhel-root /dev/termination-log xfs rw,seclabel,relatime,attr2,inode64,noquota 0 0 /dev/mapper/rhel-root /etc/metricbeat.yml xfs ro,seclabel,relatime,attr2,inode64,noquota 0 0 /dev/mapper/rhel-root /etc/hosts xfs rw,seclabel,relatime,attr2,inode64,noquota 0 0 shm /dev/shm tmpfs rw,context="system\_u:object\_r:container\_file\_t:s0:c270,c982",nosuid,nodev,noexec,relatime,size=65536k 0 0 /dev/mapper/rhel-root /run/secrets xfs rw,seclabel,relatime,attr2,inode64,noquota 0 0 /dev/mapper/rhel-root /etc/resolv.conf xfs rw,seclabel,relatime,attr2,inode64,noquota 0 0 /dev/mapper/rhel-root /etc/hostname xfs rw,seclabel,relatime,attr2,inode64,noquota 0 0 tmpfs /run/docker.sock tmpfs rw,seclabel,nosuid,nodev,mode=755 0 0 /dev/mapper/rhel-root /usr/share/metricbeat/modules.d xfs ro,seclabel,relatime,attr2,inode64,noquota 0 0 using cat /hostfs/proc/mounts can give better results as stated here [https://github.com/elastic/beats/issues/7512#issuecomment-413000978](https://github.com/elastic/beats/issues/7512#issuecomment-413000978) but how to change the usage of this command instead of above one. sh-4.2# cat /hostfs/proc/mounts rootfs / rootfs rw 0 0 /dev/mapper/docker-253:0-67491179-0cca744e6c7c134ceb5d4f42378640acbe1788d8bffbeab96eb12e25b037756a / xfs rw,context="system\_u:object\_r:container\_file\_t:s0:c270,c982",relatime,nouuid,attr2,inode64,sunit=1024,swidth=1024,noquota 0 0 proc /proc proc rw,nosuid,nodev,noexec,relatime 0 0 tmpfs /dev tmpfs rw,context="system\_u:object\_r:container\_file\_t:s0:c270,c982",nosuid,mode=755 0 0 devpts /dev/pts devpts rw,context="system\_u:object\_r:container\_file\_t:s0:c270,c982",nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=666 0 0 sysfs /sys sysfs ro,seclabel,nosuid,nodev,noexec,relatime 0 0 tmpfs /sys/fs/cgroup tmpfs ro,context="system\_u:object\_r:container\_file\_t:s0:c270,c982",nosuid,nodev,noexec,relatime,mode=755 0 0 systemd-1 /hostfs/proc/sys/fs/binfmt\_misc autofs rw,relatime,fd=32,pgrp=0,timeout=0,minproto=5,maxproto=5,direct,pipe\_ino=23485 0 0 binfmt\_misc /hostfs/proc/sys/fs/binfmt\_misc binfmt\_misc rw,relatime 0 0 nfsd /hostfs/proc/fs/nfsd nfsd rw,relatime 0 0 /dev/mapper/rhel-root /dev/termination-log xfs rw,seclabel,relatime,attr2,inode64,noquota 0 0 /dev/mapper/rhel-root /etc/metricbeat.yml xfs ro,seclabel,relatime,attr2,inode64,noquota 0 0 /dev/mapper/rhel-root /etc/hosts xfs rw,seclabel,relatime,attr2,inode64,noquota 0 0 shm /dev/shm tmpfs rw,context="system\_u:object\_r:container\_file\_t:s0:c270,c982",nosuid,nodev,noexec,relatime,size=65536k 0 0 /dev/mapper/rhel-root /run/secrets xfs rw,seclabel,relatime,attr2,inode64,noquota 0 0 /dev/mapper/rhel-root /etc/resolv.conf xfs rw,seclabel,relatime,attr2,inode64,noquota 0 0 /dev/mapper/rhel-root /etc/hostname xfs rw,seclabel,relatime,attr2,inode64,noquota 0 0 tmpfs /run/docker.sock tmpfs rw,seclabel,nosuid,nodev,mode=755 0 0 /dev/mapper/rhel-root /usr/share/metricbeat/modules.d xfs ro,seclabel,relatime,attr2,inode64,noquota 0 0 tmpfs /hostfs/sys/fs/cgroup tmpfs ro,seclabel,mode=755 0 0 cgroup /hostfs/sys/fs/cgroup/systemd cgroup rw,seclabel,nosuid,nodev,noexec,relatime,xattr,release\_agent=/usr/lib/systemd/systemd-cgroups-agent,name=systemd 0 0 cgroup /hostfs/sys/fs/cgroup/net\_cls,net\_prio cgroup rw,seclabel,nosuid,nodev,noexec,relatime,net\_prio,net\_cls 0 0 tmpfs /run/secrets/kubernetes.io/serviceaccount tmpfs ro,seclabel,relatime 0 0 Has anyone got it working collecting metricbeats filesystem running the metricbeats as docker or kubernetes? To late to reopen this article since it was already closed [How to get the all disks(Drive) via metricbeat?](https://discuss.elastic.co/t/how-to-get-the-all-disks-drive-via-metricbeat/165927) Additionally even that xfs is not stated as ignored filesystem it is not parsed by the metricbeats Thank you. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 24, 2019, 1:01pm UTC](https://discuss.elastic.co/t/metricbeat-7-0-1-system-filesystem-ignore-types-not-working-correctly/187572/2 "2019-07-24T13:01:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.