# \[SOLVED\] Many metrics to graphite via include\_metrics but from @metadata

**URL:** <https://discuss.elastic.co/t/solved-many-metrics-to-graphite-via-include-metrics-but-from-metadata/125730>\
**Category:** Logstash\
**Created:** [March 27, 2018, 10:38am UTC](https://discuss.elastic.co/t/solved-many-metrics-to-graphite-via-include-metrics-but-from-metadata/125730 "2018-03-27T10:38:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![simmel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simmel/32/48040_2.png) [@simmel](https://discuss.elastic.co/u/simmel)\
**Post date:** [March 27, 2018, 10:38am UTC](https://discuss.elastic.co/t/solved-many-metrics-to-graphite-via-include-metrics-but-from-metadata/125730/1 "2018-03-27T10:38:01Z")

</div>

I don't want to send our metrics fields which are many (ES complains that we have more than 1000 fields) and unwanted to elasticsearch.

Our previous approach was to use:

```
graphite {
  host => "graphite.domain.tld"
  fields_are_metrics => true
  timestamp_field => "@timestamp"
  include_metrics => [
    "^server\.",
    "^service\."
  ]
}

```

That doesn't avoid getting them into ES. So I thought about putting them all in the @metadata field but then I can't use any wildcard to get them all in.

```
graphite {
  host => "127.0.0.1"
  fields_are_metrics => true
  timestamp_field => "@timestamp"
  include_metrics => [
    "\[@metadata\]server\.",
    "\[@metadata\]service\."
  ]
}

```

doesn't work, obviously.

Any ideas?

---

<div class="post-metadata">

**Author:** ![simmel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simmel/32/48040_2.png) [@simmel](https://discuss.elastic.co/u/simmel)\
**Post date:** [April 16, 2018, 10:03pm UTC](https://discuss.elastic.co/t/solved-many-metrics-to-graphite-via-include-metrics-but-from-metadata/125730/2 "2018-04-16T22:03:34Z")

</div>

Hope this helps someone.

What we ended up doing is instead of:

```
if [@metadata][rsyslogd-pstats][name] =~ "^im(tcp|udp)" and [@metadata][rsyslogd-pstats][submitted] and [@metadata][rsyslogd-pstats][submitted] > 0 {
  mutate {
    add_field => {
      "server.linux_%{[@metadata][logsource_graph]}.rsyslog.%{[@metadata][rsyslogd-pstats][name]}.submitted" => "%{[@metadata][rsyslogd-pstats][submitted]}"
    }
    add_tag => ["graph"]
  }
}

```

we did:

```
if [@metadata][rsyslogd-pstats][name] =~ "^im(tcp|udp)" and [@metadata][rsyslogd-pstats][submitted] and [@metadata][rsyslogd-pstats][submitted] > 0 {
  clone {
    clones => ["graph"]
    add_field => {
      "server.linux_%{[@metadata][logsource_graph]}.rsyslog.%{[@metadata][rsyslogd-pstats][name]}.submitted" => "%{[@metadata][rsyslogd-pstats][submitted]}"
    }
    add_tag => ["graph"]
  }
}

```

which made it possible to send all events with the `graph` tag to the metrics system, in our case graphite, and `else` send it to elasticsearch, e.g:

```
if "graph" in [tags] {
  graphite {
    fields_are_metrics => true
    include_metrics => [
      "^server\.",
      "^service\."
    ]
  }
}

else {
  elasticsearch {
  }
} 

```

that way we don't get metrics extracted from the logs indexed in elasticsearch.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 14, 2018, 10:03pm UTC](https://discuss.elastic.co/t/solved-many-metrics-to-graphite-via-include-metrics-but-from-metadata/125730/3 "2018-05-14T22:03:36Z")

</div>

Closed on May 14, 2018, 10:03pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.