Metricbeat process regexp

Elastic Stack Beats
1

Hi,

I would like to see the metrics of only the processes

ps -ef | grep ".*java.DJENKINS_HOME."

I tried with the followings:

processes: ['java']
processors:

  • drop_event:
    • not:
      regexp:
      system.process.cmdline: '.*java.DJENKINS_HOME.'

but using this I do not see any a processes at all from the host. What is the proper configuration?

metricbeat version is 6.2.3.

Thanks!

2

Have tried configuring Metricbeat like this?

metricbeat.modules:
- module: system
  metricsets: ["process"]
  processes: ['.*java.DJENKINS_HOME']
3

The cmdline is like

...java...-DJENKINS_HOME... so '.*java.DJENKINS_HOME' would not be appropriate.

I also tried '.DJENKINS_HOME.', which is also wrong.

4

Could you share the debug logs of Metricbeat?

5

Metricbeat is sending the metrics to logstash. I see lines like this in the metricbeat debug log:

2018-04-18T12:09:27.172Z        DEBUG   [processes]     process/process.go:402  Filtered top processes down to 31 processes
2018-04-18T12:09:28.013Z        DEBUG   [logstash]      logstash/async.go:94    connect
2018-04-18T12:09:28.033Z        DEBUG   [logstash]      logstash/async.go:142   15 events out of 15 events sent to logstash host 57.56.135.106:5044. Continue sending

In logstash log the following entries appears:

[WARN ] 2018-04-12 15:26:51.766 [nioEventLoopGroup-3-4] DefaultChannelPipeline - An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
io.netty.handler.codec.DecoderException: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 120
        at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:459) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.channel.AbstractChannelHandlerContext.access$600(AbstractChannelHandlerContext.java:38) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.channel.AbstractChannelHandlerContext$7.run(AbstractChannelHandlerContext.java:353) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.util.concurrent.DefaultEventExecutor.run(DefaultEventExecutor.java:66) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) [netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-all-4.1.18.Final.jar:4.1.18.Final]
        at java.lang.Thread.run(Thread.java:748) [?:1.8.0_161]
Caused by: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 120
        at org.logstash.beats.BeatsParser.decode(BeatsParser.java:92) ~[logstash-input-beats-5.0.10.jar:?]
        at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        ... 8 more
[INFO ] 2018-04-12 15:26:51.814 [defaultEventExecutorGroup-5-3] BeatsHandler - [local: 172.18.0.4:5044, remote: 10.91.1.17:46626] Handling exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 105
[WARN ] 2018-04-12 15:26:51.814 [nioEventLoopGroup-3-4] DefaultChannelPipeline - An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
io.netty.handler.codec.DecoderException: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 105
        at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:459) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:392) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:359) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.channelInactive(ByteToMessageDecoder.java:342) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:245) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.channel.AbstractChannelHandlerContext.access$300(AbstractChannelHandlerContext.java:38) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.channel.AbstractChannelHandlerContext$4.run(AbstractChannelHandlerContext.java:236) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.util.concurrent.DefaultEventExecutor.run(DefaultEventExecutor.java:66) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) [netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-all-4.1.18.Final.jar:4.1.18.Final]
        at java.lang.Thread.run(Thread.java:748) [?:1.8.0_161]
Caused by: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 105
        at org.logstash.beats.BeatsParser.decode(BeatsParser.java:92) ~[logstash-input-beats-5.0.10.jar:?]
        at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        ... 10 more
[WARN ] 2018-04-13 00:00:43.410 [Ruby-0-Thread-16@[main]>worker1: :1] elasticsearch - Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"metricbeat-6.2.3-2018.04.13", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x1b2ac9c3>], :response=>{"index"=>{"_index"=>"metricbeat-6.2.3-2018.04.13", "_type"=>"doc", "_id"=>"amlNvGIBHqUENYrw4WNN", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [system.filesystem.used.pct] cannot be changed from type [long] to [float]"}}}}
[WARN ] 2018-04-13 00:00:43.439 [Ruby-0-Thread-17@[main]>worker2: :1] elasticsearch - Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"metricbeat-6.2.3-2018.04.13", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x215692ea>], :response=>{"index"=>{"_index"=>"metricbeat-6.2.3-2018.04.13", "_type"=>"doc", "_id"=>"cGlNvGIBHqUENYrw4WNN", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [system.filesystem.used.pct] cannot be changed from type [long] to [float]"}}}}
[INFO ] 2018-04-13 07:12:40.514 [defaultEventExecutorGroup-5-4] BeatsHandler - [local: 172.18.0.4:5044, remote: 10.91.1.17:32924] Handling exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 120
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.