System.fsstat filtering / processors

Elastic Stack Beats
1

More questions surrounding All numbers reported by Metricbeat too high (bug?) and https://github.com/elastic/beats/issues/2079

Is there a way to use filters or processors to limit metricbeat's collection of file systems? I need the ability to exclude non-user type mounts. (e.g. df -at ext4 -t ext3 -t xfs -t zfs -t btrfs --total)

2

I think this should definitively possible with processors: https://www.elastic.co/guide/en/beats/metricbeat/5.1/configuration-processors.html

3

I've tried the below processor with no success. I based the regex off df -a names but have no idea what or how fsstat is querying.

processors:

  • drop_event:
    when:
    regexp:
    system.fsstat:
    equals: '^(cgroup|tmpfs|rootfs|devpts|pstore|configfs|debugfs|mqueue|hugetlbfs|nfsd|sunrpc|/etc/auto.home|binfmt_misc)'
4

You can filter the events produced by the system.filesystem metricset (see example). But you cannot configure the filesystems types that are summed by the system.fsstat module. It will sum them all.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.