Metricbeat: grouping multiple metrics in one event

Elastic Stack Beats
1

Hi. Using the following configurations, I was not able to generate a single event containing multiple metrics (referring to https://www.elastic.co/guide/en/beats/metricbeat/current/key-features.html#multiple-events-in-one).

   - module: system
      metricsets: ["cpu", "memory", "fsstat"]
      enabled: true
      period: 30s
      processes: ['.*']

Instead, I see 3 separate events generated at the same time. Is there a way to have CPU, Memory, Filesystem stats all grouped into a single event using Metricbeat? Thanks.

{
  "@timestamp" => 2017 - 08 - 31 T05: 14: 55.858 Z,
    "system" => {
      "cpu" => {
        "system" => {
          "pct" => 0.0
        },
        "cores" => 2,
        "softirq" => {
          "pct" => 0.0
        },
        "idle" => {
          "pct" => 0.0
        },
        "steal" => {
          "pct" => 0.0
        },
        "irq" => {
          "pct" => 0.0
        },
        "iowait" => {
          "pct" => 0.0
        },
        "user" => {
          "pct" => 0.0
        },
        "nice" => {
          "pct" => 0.0
        }
      }
    },
    "beat" => {
      "hostname" => "agent1",
      "name" => "agent1",
      "version" => "5.5.2"
    },
    "@version" => "1",
    "host" => "agent1",
    "metricset" => {
      "rtt" => 134,
      "module" => "system",
      "name" => "cpu"
    },
    "type" => "metricsets",
    "tags" => [
      [0]
      "beats_input_raw_event"
    ]
}{
  "@timestamp" => 2017 - 08 - 31 T05: 14: 55.858 Z,
    "system" => {
      "memory" => {
        "actual" => {
          "used" => {
            "pct" => 0.0828,
            "bytes" => 159678464
          },
          "free" => 1769185280
        },
        "total" => 1928863744,
        "swap" => {
          "total" => 1073737728,
          "used" => {
            "pct" => 0.0,
            "bytes" => 0
          },
          "free" => 1073737728
        },
        "used" => {
          "pct" => 0.2328,
          "bytes" => 449048576
        },
        "free" => 1479815168
      }
    },
    "beat" => {
      "hostname" => "agent1",
      "name" => "agent1",
      "version" => "5.5.2"
    },
    "@version" => "1",
    "host" => "agent1",
    "metricset" => {
      "rtt" => 156,
      "module" => "system",
      "name" => "memory"
    },
    "type" => "metricsets",
    "tags" => [
      [0]
      "beats_input_raw_event"
    ]
}{
  "@timestamp" => 2017 - 08 - 31 T05: 14: 55.858 Z,
    "system" => {
      "fsstat" => {
        "total_files" => 42590324,
        "total_size" => {
          "total" => 1123497676800,
          "used" => 104752873472,
          "free" => 1018744803328
        },
        "count" => 33
      }
    },
    "beat" => {
      "hostname" => "agent1",
      "name" => "agent1",
      "version" => "5.5.2"
    },
    "@version" => "1",
    "host" => "agent1",
    "metricset" => {
      "rtt" => 1085,
      "module" => "system",
      "name" => "fsstat"
    },
    "type" => "metricsets",
    "tags" => [
      [0]
      "beats_input_raw_event"
    ]
}
2

Facing same issue.
Any updates on this?

3

Hello. I'm still facing the same issue with Metricbeat 5.6.3. Any thoughts or suggestions for sending multiple metrics in a single event?

4

I think there is a misunderstanding here. What is meant by multiple metrics is that steal, iowait and others are all in the same event. It's not possible to merge multiple metricsets.

Perhaps you can share some background on why you would want that?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.