Metrics format recommendations?

Elastic Stack Beats
1

Hi folks,

do you have a writeup on metrics formatting conventions?

I have looked at the topbeat and packetbeat entries in ES and it wasn't clear how it was decided that some information should have:

  • their own fields "client_port"
  • some were concatenated "proc.state"
  • some had an array ""http": {"code": 200}

There is also the source naming convention: Topbeat uses "shipper" as the source but Packetbeat has "server" and "shipper".

Do you have any guidance? Thanks!

Imre

2

Packetbeat has documentation on each of the exported fields and their meanings.

You might also find the developer guide helpful depending on what you are doing.

1 Like
3

Thank you, the Packetbeat Exported Fields document was very helpful.

It's interesting how Topbeat doesn't implement some of the fields Packetbeat defines as Required: "status" and "path".

4

status and path are required in the context of Packetbeat. I don't think they should required for all Beats, I struggle to think what we should fill them for Topbeat.

5

Another thing about topbeat metric naming: ES2.0 doesn't accept field names with commas in it, so "proc.cpu" is an invalid format.

6

You are right, we've cleaned that in master and now there's field documentation as well. From this we generate this.