# Metricbeat doesn't recognize the process **URL:** \ **Category:** Beats\ **Tags:** metricbeat\ **Created:** [February 3, 2021, 10:53pm UTC](https://discuss.elastic.co/t/metricbeat-doesnt-recognize-the-process/263176 "2021-02-03T22:53:33Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![xyz2](https://avatars.discourse-cdn.com/v4/letter/x/e480ec/32.png) [@xyz2](https://discuss.elastic.co/u/xyz2)\ **Post date:** [February 3, 2021, 10:53pm UTC](https://discuss.elastic.co/t/metricbeat-doesnt-recognize-the-process/263176/1 "2021-02-03T22:53:33Z")
HI, I have configured metricbeat to check the process status. I have noticed that it doesn't get the process info sometimes even if the process was running. It is possible that the process was not active some times but still running. What could be the possible reason ? Please suggest. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [February 4, 2021, 4:53am UTC](https://discuss.elastic.co/t/metricbeat-doesnt-recognize-the-process/263176/2 "2021-02-04T04:53:25Z")
Hi @xyz2 So what may be happening is that you are using the default system.yml (system module) see with the defaults for the p[rocess metric set](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metricset-system-process.html) so you are probably using the Top N settings and sometimes the process you are looking for is in the Top 5 other times it is not ``` - module: system period: 10s metricsets: - cpu - load - memory - network - process - process_summary - socket_summary #- entropy #- core #- diskio #- socket #- service #- users process.include_top_n: by_cpu: 5 # include top 5 processes by CPU by_memory: 5 # include top 5 processes by memory ``` Above are the default settings **`process.include_top_n`** These options allow you to filter out all processes that are not in the top N by CPU or memory, in order to reduce the number of documents created. If both the `by_cpu` and `by_memory` options are used, the union of the two sets is included. If you want all processes take out the top and use something like this **`processes`** When the `process` metricset is enabled, you can use the `processes` option to define a list of regexp expressions to filter the processes that are reported. For more complex filtering, you should use the `processors` configuration option. See [_Processors_](https://www.elastic.co/guide/en/beats/metricbeat/current/filtering-and-enhancing-data.html) for more information. The following example config returns metrics for all processes: `processes: ['.*']` Careful that might return A LOT of data ... So you can adjust there are many settings to adjust it depends on what you want. ---
**Author:** ![xyz2](https://avatars.discourse-cdn.com/v4/letter/x/e480ec/32.png) [@xyz2](https://discuss.elastic.co/u/xyz2)\ **Post date:** [February 12, 2021, 10:40pm UTC](https://discuss.elastic.co/t/metricbeat-doesnt-recognize-the-process/263176/3 "2021-02-12T22:40:21Z")
Thank you so much for the response. I need to see top 10 processes consuming the most resources + data for some specific processes always. Can I achieve that. I see am option to set the regex for specific processes. But then I will get information about only those processes, right ? Although there could be some other process which consume lot of resources . ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [February 13, 2021, 1:38am UTC](https://discuss.elastic.co/t/metricbeat-doesnt-recognize-the-process/263176/4 "2021-02-13T01:38:26Z")
Hi @xyz2 You can do both... there are probably a couple ways but here is a way you just set up to separate process collectors. First one does top N, second looks for specific processes. Give it a try ... let us know ``` - module: system period: 10s metricsets: ['process'] process.include_top_n: by_cpu: 5 # include top 5 processes by CPU by_memory: 5 # include top 5 processes by memory - module: system period: 10s metricsets: ['process'] processes: ['^sysmon*'] ``` ---
**Author:** ![xyz2](https://avatars.discourse-cdn.com/v4/letter/x/e480ec/32.png) [@xyz2](https://discuss.elastic.co/u/xyz2)\ **Post date:** [February 17, 2021, 9:24pm UTC](https://discuss.elastic.co/t/metricbeat-doesnt-recognize-the-process/263176/5 "2021-02-17T21:24:58Z")
thanks for the response. I will try this. Have a question. Adding this will also require a change in the current metrcibeat dashboard, right? In the dashboard, I only need top 10 processes as per first collector. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [February 17, 2021, 10:07pm UTC](https://discuss.elastic.co/t/metricbeat-doesnt-recognize-the-process/263176/6 "2021-02-17T22:07:09Z")
I don't think it will affect the dashboard if you leave the Top N (10) it should be fine... more data will not bother the dashboards AND I encourage you to play with the dashboards... just Edit -\> Save As New and play with it! ---
**Author:** ![xyz2](https://avatars.discourse-cdn.com/v4/letter/x/e480ec/32.png) [@xyz2](https://discuss.elastic.co/u/xyz2)\ **Post date:** [March 10, 2021, 8:45pm UTC](https://discuss.elastic.co/t/metricbeat-doesnt-recognize-the-process/263176/7 "2021-03-10T20:45:02Z")
Hi , I have multiple different processes by same process name . In my query I use process.args to look for my specific process. I specified the process name in the "processes" property as per your suggestion but still it doesn't pick that process every 30s (as defined). I disabled process.include\_top\_n and tried but no luck. What am I missing ? Also how can I differentiate whether process info is coming from process collector 1 or 2 ? Appreciate your help ! ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [March 10, 2021, 9:01pm UTC](https://discuss.elastic.co/t/metricbeat-doesnt-recognize-the-process/263176/8 "2021-03-10T21:01:54Z")
Share your config please... and query please. Let take out include\_top\_n for now and focus on the process with your specific name. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [March 10, 2021, 9:51pm UTC](https://discuss.elastic.co/t/metricbeat-doesnt-recognize-the-process/263176/9 "2021-03-10T21:51:10Z")
BTW I just tested this and it works as expected and each set is tagged appropriately please share your config and query. Also if the processes you are looking for are owned by root then you need to run metricbeat as root or with the correct privleges ``` - module: system period: 10s metricsets: ['process'] tags: ["myspecialprocess"] processes: ['^md*'] - module: system period: 10s metricsets: ['process'] tags: ["mytopprocess"] process.include_top_n: by_cpu: 5 # include top 5 processes by CPU by_memory: 5 # include top 5 processes by memory ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 7, 2021, 11:51pm UTC](https://discuss.elastic.co/t/metricbeat-doesnt-recognize-the-process/263176/10 "2021-04-07T23:51:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.