Selecting only wy WiFi interface for network metric does not seem to work

[willemdh]

Hello,

I tried multiple variations of WiFi to only log network metrics for my WiFi adapter and not for all the rest:

But whatever I try it keeps indexing metrics for all my interfaces. Anyone got an idea what I'm doing wrong? The docsonly show a Linux example. is it even possible with Windows to select the interface?

Tried:

WiFi
"WiFi"
[WiFi]
["WiFi"]

Willem

[stephenb (Stephen Brown)]

Hi @willemdh

First which integration is that... just the system network integration?

If so, I don't think those names are what the integration is looking for...

I would run and let it collect all the networks

Then look at system.network.name values then use that value to filter on....

[willemdh]

Indeed just the system network integration. I actually did exactly as you suggested. The system.network.name is WiFi..

[stephenb (Stephen Brown)]

Interesting I see the same behavior on my linux box... seems like perhaps a bug...

BUT as a workaround I just put in a drop_event processor

- drop_event.when.not.equals:
    system.network.name: docker0

Worked.

Interesting I inspected the agent... the manifest looks correct when setting the interfaces value.

$ sudo /opt/Elastic/Agent/elastic-agent inspect
...
  - data_stream:
      dataset: system.network
      type: metrics
    id: system/metrics-system.network-bfbbe64e-818c-4e66-86f2-ff9a0b6d004b
    metricsets:
    - network
    network:
      interfaces:
      - docker0 << HERE LOOKS correct not sure why not working... 
    period: 10s
...

[willemdh]

Hi @stephenb

I can confirm setting:

- drop_event.when.not.equals:
    system.network.name: WiFi

Works.

Tx

Willem

[SteveJR1 (Steve Junior)]

On Windows, the system.network metricset in Metricbeat doesn’t filter by interface name the same way the Linux examples show. That’s why trying things like WiFi, "WiFi" or ["WiFi"] isn’t working — it just keeps collecting all interfaces. The correct way on Windows is to use the exact interface name as shown by the OS. First, run this in PowerShell:

Get-NetAdapter

Check the Name column and copy it exactly (for example: Wi-Fi, not WiFi).

Then in your metricbeat.yml:

- module: system
  metricsets: ["network"]
  interfaces: ["Wi-Fi"]

Make sure the name matches exactly, including dash and capitalization. If that still doesn’t filter, another reliable workaround is to collect all interfaces and then drop the ones you don’t want using a processor:

processors:
  - drop_event:
      when:
        not:
          equals:
            system.network.name: "Wi-Fi"

That way only your Wi-Fi adapter gets indexed.