Metrics format recommendations?


Hi folks,

do you have a writeup on metrics formatting conventions?

I have looked at the topbeat and packetbeat entries in ES and it wasn't clear how it was decided that some information should have:

  • their own fields "client_port"
  • some were concatenated "proc.state"
  • some had an array ""http": {"code": 200}

There is also the source naming convention: Topbeat uses "shipper" as the source but Packetbeat has "server" and "shipper".

Do you have any guidance? Thanks!


(Andrew Kroh) #2

Packetbeat has documentation on each of the exported fields and their meanings.

You might also find the developer guide helpful depending on what you are doing.


Thank you, the Packetbeat Exported Fields document was very helpful.

It's interesting how Topbeat doesn't implement some of the fields Packetbeat defines as Required: "status" and "path".

(Tudor Golubenco) #4

status and path are required in the context of Packetbeat. I don't think they should required for all Beats, I struggle to think what we should fill them for Topbeat.


Another thing about topbeat metric naming: ES2.0 doesn't accept field names with commas in it, so "proc.cpu" is an invalid format.

(Tudor Golubenco) #6

You are right, we've cleaned that in master and now there's field documentation as well. From this we generate this.

(system) #7