Skip to content

elastic-agent system module - filesystem.ignore_types in metricbeat is not being applied #7703

@TheRiffRafi

Description

@TheRiffRafi
  • Version: 8.9.0

  • Operating System: Windows

  • Steps to Reproduce:

  1. Have a Elasticsearch - Fleet - Elastic Agent setup.
  2. Install the "system" integration to an agent. Go to the integrations settings, the metrics section, filesystem, and add to the List of filesystem types to ignore the unknown and unavailable values in a row each.
  3. Save and observe how the Elastic Agent logs still show the error:
    {"log.level":"error","@timestamp":"2023-04-06T08:59:18.495+0200","log.origin":{"[file.name](https://file.name/)":"module/wrapper.go","file.line":256},"message":"Error fetching data for metricset system.filesystem: error getting filesystem usage for [Z:\\](file:///Z://): GetDiskFreeSpaceEx failed: The device is not ready.","[service.name](https://service.name/)":"metricbeat","ecs.version":"1.6.0"}

Something worth pointing out.

I don't know if the way the list is built has something to do with this.
I went looking into how the ignore_types is done in Metricbeat (no Elastic Agent paired) and the values are each part of an array:

https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metricset-system-filesystem.html#_filtering

When looking at the Elastic Agent diagnostic, I see that the values are passed as a string-value:

 - kind:
                    structvalue:
                      fields:
                        data_stream:
                          kind:
                            structvalue:
                              fields:
                                dataset:
                                  kind:
                                    stringvalue: system.filesystem
                                type:
                                  kind:
                                    stringvalue: metrics
                        filesystem.ignore_types:
                          kind:
                            stringvalue: unknown,unavailable,cdfs

And looking at the yml file from the policy, it comes up as a string:

        filesystem.ignore_types: 'unknown,unavailable,cdfs'

I don't know enough on how the options sent to the Metricbeat process are built so my guess is probably completely wrong, but I thought it was worth pointing out.

I've seen this setting not working twice. Here is another reference: elastic/beats#35187 (comment)

Metadata

Metadata

Labels

Team:Elastic-AgentPlatform - Ingest - Agent [elastic/elastic-agent]Team:Elastic-Agent-Data-PlaneAgent Data Plane team [elastic/elastic-agent-data-plane]bugSomething isn't working, use only for issues

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions