# Metricbeat - filesystem How does metricbeat decide what filesystems to monitor?

**URL:** <https://discuss.elastic.co/t/metricbeat-filesystem-how-does-metricbeat-decide-what-filesystems-to-monitor/283828>\
**Category:** Beats\
**Tags:** docker, metricbeat\
**Created:** [September 9, 2021, 11:24pm UTC](https://discuss.elastic.co/t/metricbeat-filesystem-how-does-metricbeat-decide-what-filesystems-to-monitor/283828 "2021-09-09T23:24:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Newbie2019](https://avatars.discourse-cdn.com/v4/letter/n/e5b9ba/32.png) [@Newbie2019](https://discuss.elastic.co/u/Newbie2019)\
**Post date:** [September 9, 2021, 11:24pm UTC](https://discuss.elastic.co/t/metricbeat-filesystem-how-does-metricbeat-decide-what-filesystems-to-monitor/283828/1 "2021-09-09T23:24:55Z")

</div>

I have a question, how does metricbeat decide what filesystems it will monitor?

I configured the system module, made sure that metricsets filesystem was added, made sure no FS were being ignored, but I still could not see the FS i was looking for.

Example config

```auto
- module: system
  period: ${SYSTEM_PERIOD:1m}
  metricsets:
    - core
    - cpu
    - load
    - memory
    - network
    - diskio
    - filesystem
    - process
  cpu_ticks: false
  process.cgroups.enabled: false
  processes: ['^phantomjs$']

```

This was in a container, using upstream metricbeat docker images (7.12, i think).  
I logged onto the container and made sure that I could see the FS I was wanting to monitor using Linux commands

```auto
bash-4.2$ df -h | grep docker
/dev/nvme1n1 30G 5.9G 23G 21% /hostfs/root/var/lib/docker
bash-4.2$ lsblk 
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
loop1 7:1 0 55.4M 1 loop /hostfs/root/snap/core18/2128
nvme0n1 259:2 0 50G 0 disk 
`-nvme0n1p1 259:3 0 50G 0 part /hostfs/root
nvme2n1 259:1 0 40G 0 disk /var/share/log
loop2 7:2 0 25M 1 loop /hostfs/root/snap/amazon-ssm-agent/4046
loop0 7:0 0 32.3M 1 loop /hostfs/root/snap/snapd/12883
nvme1n1 259:0 0 30G 0 disk /hostfs/root/var/lib/docker

```

But I could never see `/hostfs/root/var/lib/docker` inside elasticsearch. I could see other FS in the above list, but not the one I was after.

Any pointers would be gratefully received.

To add, I also checked to make sure our logstash config was not messing around with any data from metricbeat.

Cheers in advanced

---

<div class="post-metadata">

**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\
**Post date:** [September 10, 2021, 9:27am UTC](https://discuss.elastic.co/t/metricbeat-filesystem-how-does-metricbeat-decide-what-filesystems-to-monitor/283828/2 "2021-09-10T09:27:53Z")

</div>

Hi @Newbie2019 ,

`system` module will collect a variety of metrics from the `hostfs` depending on the metricsets you are enabling. You can see info about what each metricset collects at [System module | Metricbeat Reference [7.14] | Elastic](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-module-system.html). I'm not sure what exactly do you expect to see about `/hostfs/root/var/lib/docker`, do you have any specific metrics in mind that you don't see being collected?

C.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 8, 2021, 11:28am UTC](https://discuss.elastic.co/t/metricbeat-filesystem-how-does-metricbeat-decide-what-filesystems-to-monitor/283828/3 "2021-10-08T11:28:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.