- Have a Elasticsearch - Fleet - Elastic Agent setup.
- Install the "system" integration to an agent. Go to the integrations settings, the metrics section, filesystem, and add to the
List of filesystem types to ignore the unknown and unavailable values in a row each.
- Save and observe how the Elastic Agent logs still show the error:
{"log.level":"error","@timestamp":"2023-04-06T08:59:18.495+0200","log.origin":{"[file.name](https://file.name/)":"module/wrapper.go","file.line":256},"message":"Error fetching data for metricset system.filesystem: error getting filesystem usage for [Z:\\](file:///Z://): GetDiskFreeSpaceEx failed: The device is not ready.","[service.name](https://service.name/)":"metricbeat","ecs.version":"1.6.0"}
Something worth pointing out.
I don't know if the way the list is built has something to do with this.
I went looking into how the ignore_types is done in Metricbeat (no Elastic Agent paired) and the values are each part of an array:
https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metricset-system-filesystem.html#_filtering
When looking at the Elastic Agent diagnostic, I see that the values are passed as a string-value:
- kind:
structvalue:
fields:
data_stream:
kind:
structvalue:
fields:
dataset:
kind:
stringvalue: system.filesystem
type:
kind:
stringvalue: metrics
filesystem.ignore_types:
kind:
stringvalue: unknown,unavailable,cdfs
And looking at the yml file from the policy, it comes up as a string:
filesystem.ignore_types: 'unknown,unavailable,cdfs'
I don't know enough on how the options sent to the Metricbeat process are built so my guess is probably completely wrong, but I thought it was worth pointing out.
I've seen this setting not working twice. Here is another reference: elastic/beats#35187 (comment)
Version: 8.9.0
Operating System: Windows
Steps to Reproduce:
List of filesystem types to ignoretheunknownandunavailablevalues in a row each.{"log.level":"error","@timestamp":"2023-04-06T08:59:18.495+0200","log.origin":{"[file.name](https://file.name/)":"module/wrapper.go","file.line":256},"message":"Error fetching data for metricset system.filesystem: error getting filesystem usage for [Z:\\](file:///Z://): GetDiskFreeSpaceEx failed: The device is not ready.","[service.name](https://service.name/)":"metricbeat","ecs.version":"1.6.0"}Something worth pointing out.
I don't know if the way the list is built has something to do with this.
I went looking into how the
ignore_typesis done in Metricbeat (no Elastic Agent paired) and the values are each part of an array:https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metricset-system-filesystem.html#_filtering
When looking at the Elastic Agent diagnostic, I see that the values are passed as a string-value:
And looking at the yml file from the policy, it comes up as a string:
I don't know enough on how the options sent to the Metricbeat process are built so my guess is probably completely wrong, but I thought it was worth pointing out.
I've seen this setting not working twice. Here is another reference: elastic/beats#35187 (comment)