I am using metricbeats v 6.4. I would like to see top 5 processes by CPU and Memory. However I only see metricbeat.exe for system.process.name. I added the processes filter and set it to regex on anything ('.'). After that change metricbeat was still the only proc to show up in Kibana. To prove that filter had affects, I tried a pattern that shouldn't find anything ('peanutbutter'), and as expected I stopped getting metricbeat.exe. Changed it back to wildcard ('.') and metricbeat.exe re-appeared.
As a side note, the provided examples were a bit confusing. I read a recommendation to do my configurations within modules.d, yet those examples all appeared to be within metricbeat.yml. It wasn't difficult to "convert" them to work in system.yml, but perhaps that is where my mistake lives. I also saw examples where cpu.metrics: [percentages, normalized_percentages, ticks] has quotes around each metric in there, and without quotes. Is what I have correct?
This is my system.yml:
# Module: system # Docs: https://www.elastic.co/guide/en/beats/metricbeat/6.4/metricbeat-module-system.html - module: system period: 10s metricsets: - cpu #- load - memory - network - process - process_summary #- core - diskio #- socket cpu.metrics: [percentages, normalized_percentages, ticks] processes: ['.*'] process.include_top_n: by_cpu: 5 # include top 5 processes by CPU by_memory: 5 # include top 5 processes by memory - module: system period: 1m metricsets: - filesystem - fsstat processors: - drop_event.when.regexp: system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|host|lib)($|/)' - module: system period: 15m metricsets: - uptime #- module: system # period: 5m # metricsets: # - raid # raid.mount_point: '/'