System.fsstat filtering / processors

[slalomnut]

More questions surrounding All numbers reported by Metricbeat too high (bug?) and https://github.com/elastic/beats/issues/2079

Is there a way to use filters or processors to limit metricbeat's collection of file systems? I need the ability to exclude non-user type mounts. (e.g. df -at ext4 -t ext3 -t xfs -t zfs -t btrfs --total)

[ruflin]

I think this should definitively possible with processors: https://www.elastic.co/guide/en/beats/metricbeat/5.1/configuration-processors.html

[slalomnut]

I've tried the below processor with no success. I based the regex off df -a names but have no idea what or how fsstat is querying.

processors:

• drop_event:
  when:
  regexp:
  system.fsstat:
  equals: '^(cgroup|tmpfs|rootfs|devpts|pstore|configfs|debugfs|mqueue|hugetlbfs|nfsd|sunrpc|/etc/auto.home|binfmt_misc)'

[andrewkroh]

You can filter the events produced by the system.filesystem metricset (see example). But you cannot configure the filesystems types that are summed by the system.fsstat module. It will sum them all.