I have a problem with the Metricbeat Windows module, I only want to monitor 5 specific services in the service monitoring. But it always transfers all events to Elasticsearch.
I've tried filtering like this in the example:
windows.service.display_name: Windows Firewall
and like this one:
What must be different for me to only receive events for the listed services?
and I have a second problem, I can't see on the dashboard how much space is left on the Windows partitions. Do I have to configure it in the Windows module or system and if so how?
The Metrictset filesystem and fsstat are active by default, but I still don't see how full/empty the partitions are in the dashboard. Seems that the information is missing.
Hi @Michi, just curious if you gave
and a try instead of
or because it's
not equals here. If we pass a
windows.service.name which equals to
XXX7, then it has to compare with all names listed above and if none of them matches, then drop that event.
Regarding to your second question, which metric exactly from metricbeat are you looking from the dashboard?
I try the and instead of or, but still all events (services statusses) are submitted
I want the partition size, the partitions are detected but its 0% all the time.
@Michi Hmmm I will spend some time today to try the
drop_event. Regarding to the
Disk Usage part, In your system.yml or metricbeat.yml, do you have
filesystem metricset enabled?
Yes the filesystem metricset is enabled in system.yml.
Sorry for the late response! For disk usage problem, I was able to reproduce it and found out the Disk Usage visualization is displaying Top 10
system.filesystem.used.pct and Order by
Doc Count instead of Order by
Average of system.filesystem.used.pct. Also group by is using
system.filesystem.mount_point instead of
Also if you toggle the different options around, some data shows up Do you want to create an issue for this in github for this? Or I can do it tomorrow.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.