# Topbeat change settings when to gather stats

**URL:** https://discuss.elastic.co/t/topbeat-change-settings-when-to-gather-stats/50982
**Category:** Beats
**Created:** [May 25, 2016, 7:42pm UTC](https://discuss.elastic.co/t/topbeat-change-settings-when-to-gather-stats/50982 "2016-05-25T19:42:30Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![vikas\_J](https://avatars.discourse-cdn.com/v4/letter/v/7ba0ec/32.png) [@vikas\_J](https://discuss.elastic.co/u/vikas_J)
#### Post date: [May 25, 2016, 7:42pm UTC](https://discuss.elastic.co/t/topbeat-change-settings-when-to-gather-stats/50982/1 "2016-05-25T19:42:31Z")

</div>

I find a strange problem in my ELK setup. I have topbeat configured to gather statistics every 3600s using:  
input:

# In seconds, defines how often to read server statistics

period: 3600

And it sends output to log stash which in turn sends to elastic search and then indexed and stored. However, I find that the indices are created everyday only once. Below is the indices files i saw:  
ls -ltr|grep topbeat  
drwxr-xr-x 8 elasticsearch elasticsearch 4096 may 19 16:23 topbeat-2016.05.19  
drwxr-xr-x 8 elasticsearch elasticsearch 4096 may 20 10:23 topbeat-2016.05.20  
drwxr-xr-x 8 elasticsearch elasticsearch 4096 may 20 21:23 topbeat-2016.05.21  
drwxr-xr-x 8 elasticsearch elasticsearch 4096 may 21 21:23 topbeat-2016.05.22  
drwxr-xr-x 8 elasticsearch elasticsearch 4096 may 22 21:23 topbeat-2016.05.23  
drwxr-xr-x 8 elasticsearch elasticsearch 4096 may 23 21:23 topbeat-2016.05.24  
drwxr-xr-x 8 elasticsearch elasticsearch 4096 may 24 21:23 topbeat-2016.05.25

It seems to get created at 21:23 everyday, any clue as to what settings governs this appreciated.

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [May 25, 2016, 10:05pm UTC](https://discuss.elastic.co/t/topbeat-change-settings-when-to-gather-stats/50982/2 "2016-05-25T22:05:46Z")

</div>

What timezone is being used for the `ls` output?

The new indices will be created when the first event of the new day is reported. And the new day starts at 00:00 UTC (not your local timezone).

---

<div class="post-metadata">

### Author: ![vikas\_J](https://avatars.discourse-cdn.com/v4/letter/v/7ba0ec/32.png) [@vikas\_J](https://discuss.elastic.co/u/vikas_J)
#### Post date: [May 26, 2016, 1:17pm UTC](https://discuss.elastic.co/t/topbeat-change-settings-when-to-gather-stats/50982/3 "2016-05-26T13:17:18Z")

</div>

Its ART(Argentina timezone) . How do i check which timezone is set at topbeat level?

---

<div class="post-metadata">

### Author: ![vikas\_J](https://avatars.discourse-cdn.com/v4/letter/v/7ba0ec/32.png) [@vikas\_J](https://discuss.elastic.co/u/vikas_J)
#### Post date: [May 26, 2016, 1:32pm UTC](https://discuss.elastic.co/t/topbeat-change-settings-when-to-gather-stats/50982/4 "2016-05-26T13:32:41Z")

</div>

On querying elastic search, I see that the latest data send by topbeat-\>log stash-\>elastic search, is that of 21:23 of the previous day. Say i run a query on May 26th 12 pm, the latest data i will find is May 25th 21:23 . How do i configure topbeat to fetch more near real time statistics. I have already given period:3600. So i thought every 3600s, system statistics would be gather which is not apparently happening. Any help please

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [May 26, 2016, 2:05pm UTC](https://discuss.elastic.co/t/topbeat-change-settings-when-to-gather-stats/50982/5 "2016-05-26T14:05:45Z")

</div>

ART timezone is UTC-3 which means 21:23 ART is equivalent to 00:23 UTC. So at the 23rd minute of every hour Topbeat reports metrics, and since 00:23 UTC is a new day, a new daily index is created.

> [@vikas\_J](#):
>
> How do i check which timezone is set at topbeat level?

Topbeat doesn't care about the host's timezone, it uses UTC.

> [@vikas\_J](#):
>
> How do i configure topbeat to fetch more near real time statistics. I have already given period:3600.

Fetching metrics every one hour is not real-time IMO. The default reporting period for Topbeat is 10 seconds. Try running with the default value for a bit.

---

<div class="post-metadata">

### Author: ![vikas\_J](https://avatars.discourse-cdn.com/v4/letter/v/7ba0ec/32.png) [@vikas\_J](https://discuss.elastic.co/u/vikas_J)
#### Post date: [May 26, 2016, 2:09pm UTC](https://discuss.elastic.co/t/topbeat-change-settings-when-to-gather-stats/50982/6 "2016-05-26T14:09:39Z")

</div>

Cant i configure so that the index creation happens like every 30 minutes or so instead of index being created for just once a day?  
As per current settings, only metrics for the previous day per hour is available. To get todays metrics per hour loaded in elastic search , I will have to wait till 21:23 ART

---

<div class="post-metadata">

### Author: ![vikas\_J](https://avatars.discourse-cdn.com/v4/letter/v/7ba0ec/32.png) [@vikas\_J](https://discuss.elastic.co/u/vikas_J)
#### Post date: [May 26, 2016, 2:21pm UTC](https://discuss.elastic.co/t/topbeat-change-settings-when-to-gather-stats/50982/7 "2016-05-26T14:21:51Z")

</div>

Thanks andrew for the help. It seems to be working now. Apparently topbeat was crashing due to "divide by zero" error. I had changed output bulk\_max\_size to 0 which was causing the issue. Changed it back to 1024 and that did the trick.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 9:51pm UTC](https://discuss.elastic.co/t/topbeat-change-settings-when-to-gather-stats/50982/8 "2017-07-05T21:51:27Z")

</div>


