Metricbeat not show volume mount under dev filesystem

Elastic Observability Metrics
1

Let me explain the problem. Im searching for a specific mount in a server (actually is a volume added), and when in terminal type df -aTh | grep "/dev" for show filesystem, its show this image:

Captura de pantalla de 2022-06-28 12-53-08
Captura de pantalla de 2022-06-28 12-53-08796×326 69.4 KB

Then in metricbeat.yaml i have this configuration for system module:

- module: system
  period: 30s
  metricsets: ["filesystem"]
  processors:
   - drop_event.when.regexp:
       system.filesystem.mount_point: '^/(sys|cgroup|proc|etc|host|hostfs)($|/)'

Notice in last line i omitted "dev" , because i want to obtain the mount volume "/dev/sda" high lighted in the screen shot. But when i discoverd in kibana, that device is not showed, and i dont now why, must be showed.

Captura de pantalla de 2022-06-28 13-02-35
Captura de pantalla de 2022-06-28 13-02-35753×614 72.9 KB

Please help. Thank you for reading :slight_smile:

2

Hi Felipe!

system.filesystem.mount_point corresponds to the "Mounted on" (far right) column reported in df

Do you see "/mnt/volume_sfo3_01" in your data? That would be /dev/sda.

You could also filter (or query) using system.filesystem.device_name which would give you the "Filesystem" (far left) column of the df output.