# Where does Metricbeat get its system.diskio data?

**URL:** <https://discuss.elastic.co/t/where-does-metricbeat-get-its-system-diskio-data/310303>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [July 21, 2022, 1:42pm UTC](https://discuss.elastic.co/t/where-does-metricbeat-get-its-system-diskio-data/310303 "2022-07-21T13:42:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![defalt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/defalt/32/71379_2.png) [@defalt](https://discuss.elastic.co/u/defalt)\
**Post date:** [July 21, 2022, 1:42pm UTC](https://discuss.elastic.co/t/where-does-metricbeat-get-its-system-diskio-data/310303/1 "2022-07-21T13:42:00Z")

</div>

Hello, this is more of a technical question. Where does Metricbeat get its data about system.diskio?

I had problems with my disks in my cluster so I want to accurately track my total disk writes. I installed Metricbeat and activated system.diskio. I get the data, no problem.

The field `system.diskio.write.bytes` tells me around 2000GB. Sounds reasonable. But how does Metricbeat actually collect this data? Were is it from?

When I use other `CrystalDiskInfo` it tells me the `Write Sector Count` is **X** , every sector has **512** Bytes. **XY \* 512Bytes = 8000GB**. So one of the values is 6TB off. Thats a bit much and not really reliable.

Thanks for any input.

---

<div class="post-metadata">

**Author:** ![cmacknz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cmacknz/32/103773_2.png) [@cmacknz](https://discuss.elastic.co/u/cmacknz)\
**Post date:** [July 21, 2022, 6:58pm UTC](https://discuss.elastic.co/t/where-does-metricbeat-get-its-system-diskio-data/310303/2 "2022-07-21T18:58:20Z")

</div>

Assuming you are on Windows, then the code to get the disk IO stats on Windows can be found [here](https://github.com/elastic/elastic-agent-system-metrics/blob/main/metric/system/diskio/diskstat_windows_helper.go#L93) for recent 8.x releases.

Metricbeat is using the [deviceiocontrol](https://docs.microsoft.com/en-us/windows/win32/api/ioapiset/nf-ioapiset-deviceiocontrol) function with the [IOCTL\_DISK\_PERFORMANCE](https://docs.microsoft.com/en-us/windows/win32/api/winioctl/ni-winioctl-ioctl_disk_performance) control code to obtain drive statistics. That call gives metricbeat a [DISK\_PERFORMANCE](https://docs.microsoft.com/en-us/windows/win32/api/winioctl/ns-winioctl-disk_performance) structure as a response and the `system.diskio.write.bytes` value maps to the `BytesWritten` in the DISK\_PERFORMANCE structure.

I found what I think is [the source code for CrystalDiskInfo](https://github.com/hiyohiyo/CrystalDiskInfo/blob/master/AtaSmart.cpp) and it appears to be using different APIs based on drive type and vendor in some cases. This is much more specialized than what metricbeat is doing right now.

---

<div class="post-metadata">

**Author:** ![defalt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/defalt/32/71379_2.png) [@defalt](https://discuss.elastic.co/u/defalt)\
**Post date:** [July 22, 2022, 6:27am UTC](https://discuss.elastic.co/t/where-does-metricbeat-get-its-system-diskio-data/310303/3 "2022-07-22T06:27:56Z")

</div>

Great answer, thank you for your insight!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 19, 2022, 8:28am UTC](https://discuss.elastic.co/t/where-does-metricbeat-get-its-system-diskio-data/310303/4 "2022-08-19T08:28:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.