I have metricbeat installed on a Windows Server 2016 Datacenter server that also has an Elasticsearch node.
I also have metricbeat installed on a Windows Server 2012 Standard server with an Elasticsearch node as well in the same Elasticsearch cluster as the 2016 server.
Both on Elastic Stack 7.1.1.
Only the system module is enabled and configured identically on both servers:
# Module: system # Docs: https://www.elastic.co/guide/en/beats/metricbeat/7.1/metricbeat-module-system.html - module: system period: 10s metricsets: - cpu #- load - memory - network - process - process_summary - socket_summary #- core #- diskio #- socket process.include_top_n: by_cpu: 20 # include top 20 processes by CPU by_memory: 20 # include top 20 processes by memory - module: system period: 1m metricsets: - filesystem - fsstat processors: - drop_event.when.regexp: system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|host|lib)($|/)' - module: system period: 15m metricsets: - uptime #- module: system # period: 5m # metricsets: # - raid # raid.mount_point: '/'
At this point metricbeat has been running for around 1 week, and the memory usage on the 2016 server is > 3GB:
On the 2012 server it is significantly lower:
Any clue as to why this is happening only on the 2016 server?
Area chart of the memory usage in the past week: