# Metricbeat yaml drop\_event.when.regexp.mount\_point filter not working as expected not working as expected

**URL:** <https://discuss.elastic.co/t/metricbeat-yaml-drop-event-when-regexp-mount-point-filter-not-working-as-expected-not-working-as-expected/125275>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [March 22, 2018, 9:59pm UTC](https://discuss.elastic.co/t/metricbeat-yaml-drop-event-when-regexp-mount-point-filter-not-working-as-expected-not-working-as-expected/125275 "2018-03-22T21:59:27Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![naveengauba](https://avatars.discourse-cdn.com/v4/letter/n/5fc32e/32.png) [@naveengauba](https://discuss.elastic.co/u/naveengauba)\
**Post date:** [March 22, 2018, 9:59pm UTC](https://discuss.elastic.co/t/metricbeat-yaml-drop-event-when-regexp-mount-point-filter-not-working-as-expected-not-working-as-expected/125275/1 "2018-03-22T21:59:28Z")

</div>

Hi there

I am using metricbeat to monitor storage for a specific mount\_point on Linux machine. In order to get to data for that mount\_point I am using the drop\_event.when.regexp.mount\_point filter in the metricbeat.yaml.

Here is the filter config. I want all the mount\_points other than '/' to be filtered out from the beats output.

```auto
- module: system
  enabled: true
  period: 10s
  metricsets:
    - cpu
    - memory
    - filesystem
  filters:
    - drop_event.when.regexp.mount_point: '/[a-zA-Z0-9//]+'

```

This solution does not work on Ubuntu 14.0.04 machine. No matter what RegEx I use I get data for all mount\_points on the system which are

"mount\_point":"/"  
"mount\_point":"/run/shm"  
"mount\_point":"/run/user"  
"mount\_point":"/boot"  
"mount\_point":"/sys/fs/cgroup"

Here is the output from the metricbeat logs where it parses that RegEx. Let me know if you need any further details from my side.

2018-03-22T14:58:06-07:00 DBG New condition regexp: map[mount\_point:/[/-9A-Za-z]+]  
2018-03-22T14:58:06-07:00 DBG Processors: drop\_event, condition=regexp: map[mount\_point:/[/-9A-Za-z]+]

Please help.

thanks..Naveen Gauba

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 22, 2018, 11:22pm UTC](https://discuss.elastic.co/t/metricbeat-yaml-drop-event-when-regexp-mount-point-filter-not-working-as-expected-not-working-as-expected/125275/2 "2018-03-22T23:22:02Z")

</div>

What Metricbeat version are you using? And have you seen the [filtering examples](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metricset-system-filesystem.html#_filtering)?

---

<div class="post-metadata">

**Author:** ![naveengauba](https://avatars.discourse-cdn.com/v4/letter/n/5fc32e/32.png) [@naveengauba](https://discuss.elastic.co/u/naveengauba)\
**Post date:** [March 22, 2018, 11:46pm UTC](https://discuss.elastic.co/t/metricbeat-yaml-drop-event-when-regexp-mount-point-filter-not-working-as-expected-not-working-as-expected/125275/3 "2018-03-22T23:46:18Z")

</div>

The version of metricbeat we are using is 6.0.0. I see that the example you pointed configures the filter differently. I tried that and failed. Will try that again and respond shortly.

---

<div class="post-metadata">

**Author:** ![naveengauba](https://avatars.discourse-cdn.com/v4/letter/n/5fc32e/32.png) [@naveengauba](https://discuss.elastic.co/u/naveengauba)\
**Post date:** [March 22, 2018, 11:57pm UTC](https://discuss.elastic.co/t/metricbeat-yaml-drop-event-when-regexp-mount-point-filter-not-working-as-expected-not-working-as-expected/125275/4 "2018-03-22T23:57:42Z")

</div>

This time I tried with the example you pointed. But this did not work either. I still see MB monitoring the mount points such as /dev, /dev/pts etc

metricbeat.modules:

- module: system  
period: 30s  
metricsets: ["filesystem"]  
processors:
  - drop\_event.when.regexp:  
system.filesystem.mount\_point: '^/(sys|cgroup|proc|dev|etc|host)($|/)'

Also I did not see the log message with the mount\_point regex in the logs.

Looks like this is the only filter configuration that is actually processed by the system. As I can see the log messages reading the same. Hoever it does not really excludes the mount\_points.

#------------------------------- System Module -------------------------------

- module: system  
enabled: true  
period: 10s  
metricsets:
  - filesystem  
filters:
  - drop\_event.when.regexp.mount\_point: '^/(sys|cgroup|proc|dev|etc|host)($|/)'

Here is the log snippet.

2018-03-22T17:01:17-07:00 DBG Initializing Module type 'system': \*system.Module={name:"system", config:{Module:"system", MetricSets:[filesystem], Enabled:true, Hosts:[0 hosts], Period:"10s", Timeout:"10s", Raw:false, Fields:null, FieldsUnderRoot:false, Tags:[]}}  
2018-03-22T17:01:17-07:00 DBG New condition regexp: map[mount\_point:\A/(?:sys|cgroup|proc|dev|etc|host)(?:(?-m:$)|/)]  
2018-03-22T17:01:17-07:00 DBG Processors: drop\_event, condition=regexp: map[mount\_point:\A/(?:sys|cgroup|proc|dev|etc|host)(?:(?-m:$)|/)]

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 20, 2018, 12:01am UTC](https://discuss.elastic.co/t/metricbeat-yaml-drop-event-when-regexp-mount-point-filter-not-working-as-expected-not-working-as-expected/125275/5 "2018-04-20T00:01:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.