System mount points data via metricbeat

[cppatel]

I am unable to find /dev/shm data of my hosts on which I have installed metricbeat and enabled a below metricset:
metricsets:
- filesystem
- fsstat
processors:

• drop_event.when.regexp:
  system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|host|lib)($|/)'

Please find a system.yml configuration below:

Module: system

Docs: https://www.elastic.co/guide/en/beats/metricbeat/6.6/metricbeat-module-system.html

• module: system
  period: 10s
  metricsets:
  #- cpu

  • load
  • memory
  • network
  • process
  • process_summary
    #- core
    #- diskio
    #- socket
    process.include_top_n:
    by_cpu: 5 # include top 5 processes by CPU
    by_memory: 5 # include top 5 processes by memory

• module: system
  period: 1m
  metricsets:

  • filesystem
  • fsstat
    processors:
  • drop_event.when.regexp:
    system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|host|lib)($|/)'

• module: system
  period: 15m
  metricsets:

  • uptime

• module: system
  metricsets:
  cpu.metrics: ["percentages", "normalized_percentages"]

#- module: system

period: 5m

metricsets:

- raid

raid.mount_point: '/'

Note: While I am filtering the term system.filesystem.device_name:"/dev/shm" , it is showing no result found in kibana. Please guide me through system.yml configuration.

[ruflin]

Do you see no data at all or only this device is missing?

[cppatel]

Only this device is missing from system.filesystem.device_name field!
everything else from system data is available to choose from the values under tha field.

[ruflin]

What happens if you remove the drop_event part from the config? Will you then see it?

[cppatel]

Thanks ruflin,

I assume that having a drop_event in config file, it is taking all other devices listed under /dev/* then ideally it should list /dev/shm also. I wonder of this happening. Kindly correct me if I interpreted it wrong.