# Metricbeat process regexp

**URL:** <https://discuss.elastic.co/t/metricbeat-process-regexp/128486>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [April 18, 2018, 8:42am UTC](https://discuss.elastic.co/t/metricbeat-process-regexp/128486 "2018-04-18T08:42:00Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![bayerb](https://avatars.discourse-cdn.com/v4/letter/b/f08c70/32.png) [@bayerb](https://discuss.elastic.co/u/bayerb)\
**Post date:** [April 18, 2018, 8:42am UTC](https://discuss.elastic.co/t/metricbeat-process-regexp/128486/1 "2018-04-18T08:42:00Z")

</div>

Hi,

I would like to see the metrics of only the processes

ps -ef | grep ".\*java._DJENKINS\_HOME._"

I tried with the followings:

processes: ['java']  
processors:

- drop\_event:
  - not:  
regexp:  
system.process.cmdline: '.\*java._DJENKINS\_HOME._'

but using this I do not see any a processes at all from the host. What is the proper configuration?

metricbeat version is 6.2.3.

Thanks!

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [April 18, 2018, 9:46am UTC](https://discuss.elastic.co/t/metricbeat-process-regexp/128486/2 "2018-04-18T09:46:52Z")

</div>

Have tried configuring Metricbeat like this?

```auto
metricbeat.modules:
- module: system
  metricsets: ["process"]
  processes: ['.*java.DJENKINS_HOME']

```

---

<div class="post-metadata">

**Author:** ![bayerb](https://avatars.discourse-cdn.com/v4/letter/b/f08c70/32.png) [@bayerb](https://discuss.elastic.co/u/bayerb)\
**Post date:** [April 18, 2018, 10:36am UTC](https://discuss.elastic.co/t/metricbeat-process-regexp/128486/3 "2018-04-18T10:36:22Z")

</div>

The cmdline is like

...java...-DJENKINS\_HOME... so '.\*java.DJENKINS\_HOME' would not be appropriate.

I also tried '._DJENKINS\_HOME._', which is also wrong.

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [April 18, 2018, 10:42am UTC](https://discuss.elastic.co/t/metricbeat-process-regexp/128486/4 "2018-04-18T10:42:56Z")

</div>

Could you share the debug logs of Metricbeat?

---

<div class="post-metadata">

**Author:** ![bayerb](https://avatars.discourse-cdn.com/v4/letter/b/f08c70/32.png) [@bayerb](https://discuss.elastic.co/u/bayerb)\
**Post date:** [April 18, 2018, 12:16pm UTC](https://discuss.elastic.co/t/metricbeat-process-regexp/128486/5 "2018-04-18T12:16:34Z")

</div>

Metricbeat is sending the metrics to logstash. I see lines like this in the metricbeat debug log:

```
2018-04-18T12:09:27.172Z DEBUG [processes] process/process.go:402 Filtered top processes down to 31 processes
2018-04-18T12:09:28.013Z DEBUG [logstash] logstash/async.go:94 connect
2018-04-18T12:09:28.033Z DEBUG [logstash] logstash/async.go:142 15 events out of 15 events sent to logstash host 57.56.135.106:5044. Continue sending

```

In logstash log the following entries appears:

```
[WARN] 2018-04-12 15:26:51.766 [nioEventLoopGroup-3-4] DefaultChannelPipeline - An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
io.netty.handler.codec.DecoderException: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 120
        at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:459) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.channel.AbstractChannelHandlerContext.access$600(AbstractChannelHandlerContext.java:38) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.channel.AbstractChannelHandlerContext$7.run(AbstractChannelHandlerContext.java:353) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.util.concurrent.DefaultEventExecutor.run(DefaultEventExecutor.java:66) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) [netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-all-4.1.18.Final.jar:4.1.18.Final]
        at java.lang.Thread.run(Thread.java:748) [?:1.8.0_161]
Caused by: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 120
        at org.logstash.beats.BeatsParser.decode(BeatsParser.java:92) ~[logstash-input-beats-5.0.10.jar:?]
        at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        ... 8 more
[INFO] 2018-04-12 15:26:51.814 [defaultEventExecutorGroup-5-3] BeatsHandler - [local: 172.18.0.4:5044, remote: 10.91.1.17:46626] Handling exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 105
[WARN] 2018-04-12 15:26:51.814 [nioEventLoopGroup-3-4] DefaultChannelPipeline - An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
io.netty.handler.codec.DecoderException: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 105
        at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:459) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:392) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:359) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.channelInactive(ByteToMessageDecoder.java:342) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:245) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.channel.AbstractChannelHandlerContext.access$300(AbstractChannelHandlerContext.java:38) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.channel.AbstractChannelHandlerContext$4.run(AbstractChannelHandlerContext.java:236) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.util.concurrent.DefaultEventExecutor.run(DefaultEventExecutor.java:66) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) [netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-all-4.1.18.Final.jar:4.1.18.Final]
        at java.lang.Thread.run(Thread.java:748) [?:1.8.0_161]
Caused by: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 105
        at org.logstash.beats.BeatsParser.decode(BeatsParser.java:92) ~[logstash-input-beats-5.0.10.jar:?]
        at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        ... 10 more
[WARN] 2018-04-13 00:00:43.410 [Ruby-0-Thread-16@[main]>worker1: :1] elasticsearch - Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"metricbeat-6.2.3-2018.04.13", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x1b2ac9c3>], :response=>{"index"=>{"_index"=>"metricbeat-6.2.3-2018.04.13", "_type"=>"doc", "_id"=>"amlNvGIBHqUENYrw4WNN", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [system.filesystem.used.pct] cannot be changed from type [long] to [float]"}}}}
[WARN] 2018-04-13 00:00:43.439 [Ruby-0-Thread-17@[main]>worker2: :1] elasticsearch - Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"metricbeat-6.2.3-2018.04.13", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x215692ea>], :response=>{"index"=>{"_index"=>"metricbeat-6.2.3-2018.04.13", "_type"=>"doc", "_id"=>"cGlNvGIBHqUENYrw4WNN", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [system.filesystem.used.pct] cannot be changed from type [long] to [float]"}}}}
[INFO] 2018-04-13 07:12:40.514 [defaultEventExecutorGroup-5-4] BeatsHandler - [local: 172.18.0.4:5044, remote: 10.91.1.17:32924] Handling exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 120
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 16, 2018, 12:16pm UTC](https://discuss.elastic.co/t/metricbeat-process-regexp/128486/6 "2018-05-16T12:16:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.