Metricbeat - filesystem How does metricbeat decide what filesystems to monitor?

I have a question, how does metricbeat decide what filesystems it will monitor?

I configured the system module, made sure that metricsets filesystem was added, made sure no FS were being ignored, but I still could not see the FS i was looking for.

Example config

- module: system
  period: ${SYSTEM_PERIOD:1m}
    - core
    - cpu
    - load
    - memory
    - network
    - diskio
    - filesystem
    - process
  cpu_ticks: false
  process.cgroups.enabled: false
  processes: ['^phantomjs$']

This was in a container, using upstream metricbeat docker images (7.12, i think).
I logged onto the container and made sure that I could see the FS I was wanting to monitor using Linux commands

bash-4.2$ df -h  | grep docker
/dev/nvme1n1     30G  5.9G   23G  21% /hostfs/root/var/lib/docker
bash-4.2$ lsblk 
loop1         7:1    0 55.4M  1 loop /hostfs/root/snap/core18/2128
nvme0n1     259:2    0   50G  0 disk 
`-nvme0n1p1 259:3    0   50G  0 part /hostfs/root
nvme2n1     259:1    0   40G  0 disk /var/share/log
loop2         7:2    0   25M  1 loop /hostfs/root/snap/amazon-ssm-agent/4046
loop0         7:0    0 32.3M  1 loop /hostfs/root/snap/snapd/12883
nvme1n1     259:0    0   30G  0 disk /hostfs/root/var/lib/docker

But I could never see /hostfs/root/var/lib/docker inside elasticsearch. I could see other FS in the above list, but not the one I was after.

Any pointers would be gratefully received.

To add, I also checked to make sure our logstash config was not messing around with any data from metricbeat.

Cheers in advanced

Hi @Newbie2019 ,

system module will collect a variety of metrics from the hostfs depending on the metricsets you are enabling. You can see info about what each metricset collects at System module | Metricbeat Reference [7.14] | Elastic. I'm not sure what exactly do you expect to see about /hostfs/root/var/lib/docker, do you have any specific metrics in mind that you don't see being collected?


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.