Metricbeat yaml drop_event.when.regexp.mount_point filter not working as expected not working as expected

Hi there

I am using metricbeat to monitor storage for a specific mount_point on Linux machine. In order to get to data for that mount_point I am using the drop_event.when.regexp.mount_point filter in the metricbeat.yaml.

Here is the filter config. I want all the mount_points other than '/' to be filtered out from the beats output.

- module: system
  enabled: true
  period: 10s
    - cpu
    - memory
    - filesystem
    - drop_event.when.regexp.mount_point: '/[a-zA-Z0-9//]+'

This solution does not work on Ubuntu 14.0.04 machine. No matter what RegEx I use I get data for all mount_points on the system which are


Here is the output from the metricbeat logs where it parses that RegEx. Let me know if you need any further details from my side.

2018-03-22T14:58:06-07:00 DBG New condition regexp: map[mount_point:/[/-9A-Za-z]+]
2018-03-22T14:58:06-07:00 DBG Processors: drop_event, condition=regexp: map[mount_point:/[/-9A-Za-z]+]

Please help.

thanks..Naveen Gauba

What Metricbeat version are you using? And have you seen the filtering examples?

The version of metricbeat we are using is 6.0.0. I see that the example you pointed configures the filter differently. I tried that and failed. Will try that again and respond shortly.

This time I tried with the example you pointed. But this did not work either. I still see MB monitoring the mount points such as /dev, /dev/pts etc


  • module: system
    period: 30s
    metricsets: ["filesystem"]
    • drop_event.when.regexp:
      system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|host)($|/)'

Also I did not see the log message with the mount_point regex in the logs.

Looks like this is the only filter configuration that is actually processed by the system. As I can see the log messages reading the same. Hoever it does not really excludes the mount_points.

#------------------------------- System Module -------------------------------

  • module: system
    enabled: true
    period: 10s
    • filesystem
    • drop_event.when.regexp.mount_point: '^/(sys|cgroup|proc|dev|etc|host)($|/)'

Here is the log snippet.

2018-03-22T17:01:17-07:00 DBG Initializing Module type 'system': *system.Module={name:"system", config:{Module:"system", MetricSets:[filesystem], Enabled:true, Hosts:[0 hosts], Period:"10s", Timeout:"10s", Raw:false, Fields:null, FieldsUnderRoot:false, Tags:[]}}
2018-03-22T17:01:17-07:00 DBG New condition regexp: map[mount_point:\A/(?:sys|cgroup|proc|dev|etc|host)(?:(?-m:$)|/)]
2018-03-22T17:01:17-07:00 DBG Processors: drop_event, condition=regexp: map[mount_point:\A/(?:sys|cgroup|proc|dev|etc|host)(?:(?-m:$)|/)]

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.