New

The executive guide to generative AI

Read more
About usPartnersSupport|Login
IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« System network metricset System process_summary metricset »
Elastic Docs ›Metricbeat Reference [6.5] ›Modules ›System module

System process metricset

edit

System process metricset

edit

The System process metricset provides process statistics. One document is provided for each process.

This metricset is available on:

  • FreeBSD
  • Linux
  • macOS
  • Windows

Configuration

edit
processes

When the process metricset is enabled, you can use the processes option to define a list of regexp expressions to filter the processes that are reported. For more complex filtering, you should use the processors configuration option. See Filter and enhance the exported data for more information.

The following example config returns metrics for all processes:

metricbeat.modules:
- module: system
  metricsets: ["process"]
  processes: ['.*']
process.cgroups.enabled

When the process metricset is enabled, you can use this boolean configuration option to disable cgroup metrics. By default cgroup metrics collection is enabled.

The following example config disables cgroup metrics on Linux.

metricbeat.modules:
- module: system
  metricsets: ["process"]
  process.cgroups.enabled: false
process.cmdline.cache.enabled
This metricset caches the command line args for a running process by default. This means if you alter the command line for a process while this metricset is running, these changes are not detected. Caching can be disabled by setting process.cmdline.cache.enabled: false in the configuration.
process.env.whitelist

This metricset can collect the environment variables that were used to start the process. This feature is available on Linux, Darwin, and FreeBSD. No environment variables are collected by default because they could contain sensitive information. You must configure the environment variables that you wish to collect by specifying a list of regular expressions that match the variable name. 

metricbeat.modules:
- module: system
  metricsets: ["process"]
  process.env.whitelist:
  - '^PATH$'
  - '^SSH_.*'
process.include_cpu_ticks

By default the cumulative CPU tick values are not reported by this metricset (only percentages are reported). Setting this option to true will enable the reporting of the raw CPU tick values (for user, system, and total CPU time). 

metricbeat.modules:
- module: system
  metricsets: ["process"]
  process.include_cpu_ticks: true
process.include_top_n
These options allow you to filter out all processes that are not in the top N by CPU or memory, in order to reduce the number of documents created. If both the by_cpu and by_memory options are used, the union of the two sets is included.
process.include_top_n.enabled
Set to false to disable the top N feature and include all processes, regardless of the other options. The default is true, but nothing is filtered unless one of the other options (by_cpu or by_memory) is set to a non-zero value.
process.include_top_n.by_cpu
How many processes to include from the top by CPU. The processes are sorted by the system.process.cpu.total.pct field. The default is 0.
process.include_top_n.by_memory
How many processes to include from the top by memory. The processes are sorted by the system.process.memory.rss.bytes field. The default is 0.

Fields

edit

For a description of each field in the metricset, see the exported fields section.

Here is an example document generated by this metricset:

{
    "@timestamp": "2017-10-12T08:05:34.853Z",
    "beat": {
        "hostname": "host.example.com",
        "name": "host.example.com"
    },
    "metricset": {
        "module": "system",
        "name": "process",
        "rtt": 115
    },
    "system": {
        "process": {
            "cgroup": {
                "blkio": {
                    "id": "d88e67bb6961a5bb70c1c1c48094c6030e43768eed91e827f437111888f9967e",
                    "path": "/docker/d88e67bb6961a5bb70c1c1c48094c6030e43768eed91e827f437111888f9967e",
                    "total": {
                        "bytes": 0,
                        "ios": 0
                    }
                },
                "cpu": {
                    "cfs": {
                        "period": {
                            "us": 0
                        },
                        "quota": {
                            "us": 0
                        },
                        "shares": 0
                    },
                    "id": "d88e67bb6961a5bb70c1c1c48094c6030e43768eed91e827f437111888f9967e",
                    "path": "/docker/d88e67bb6961a5bb70c1c1c48094c6030e43768eed91e827f437111888f9967e",
                    "rt": {
                        "period": {
                            "us": 0
                        },
                        "runtime": {
                            "us": 0
                        }
                    },
                    "stats": {
                        "periods": 0,
                        "throttled": {
                            "ns": 0,
                            "periods": 0
                        }
                    }
                },
                "cpuacct": {
                    "id": "d88e67bb6961a5bb70c1c1c48094c6030e43768eed91e827f437111888f9967e",
                    "path": "/docker/d88e67bb6961a5bb70c1c1c48094c6030e43768eed91e827f437111888f9967e",
                    "percpu": {},
                    "stats": {
                        "system": {
                            "ns": 0
                        },
                        "user": {
                            "ns": 0
                        }
                    },
                    "total": {
                        "ns": 0
                    }
                },
                "id": "d88e67bb6961a5bb70c1c1c48094c6030e43768eed91e827f437111888f9967e",
                "memory": {
                    "id": "d88e67bb6961a5bb70c1c1c48094c6030e43768eed91e827f437111888f9967e",
                    "kmem": {
                        "failures": 0,
                        "limit": {
                            "bytes": 0
                        },
                        "usage": {
                            "bytes": 0,
                            "max": {
                                "bytes": 0
                            }
                        }
                    },
                    "kmem_tcp": {
                        "failures": 0,
                        "limit": {
                            "bytes": 0
                        },
                        "usage": {
                            "bytes": 0,
                            "max": {
                                "bytes": 0
                            }
                        }
                    },
                    "mem": {
                        "failures": 0,
                        "limit": {
                            "bytes": 0
                        },
                        "usage": {
                            "bytes": 0,
                            "max": {
                                "bytes": 0
                            }
                        }
                    },
                    "memsw": {
                        "failures": 0,
                        "limit": {
                            "bytes": 0
                        },
                        "usage": {
                            "bytes": 0,
                            "max": {
                                "bytes": 0
                            }
                        }
                    },
                    "path": "/docker/d88e67bb6961a5bb70c1c1c48094c6030e43768eed91e827f437111888f9967e",
                    "stats": {
                        "active_anon": {
                            "bytes": 0
                        },
                        "active_file": {
                            "bytes": 0
                        },
                        "cache": {
                            "bytes": 0
                        },
                        "hierarchical_memory_limit": {
                            "bytes": 0
                        },
                        "hierarchical_memsw_limit": {
                            "bytes": 0
                        },
                        "inactive_anon": {
                            "bytes": 0
                        },
                        "inactive_file": {
                            "bytes": 0
                        },
                        "major_page_faults": 0,
                        "mapped_file": {
                            "bytes": 0
                        },
                        "page_faults": 0,
                        "pages_in": 0,
                        "pages_out": 0,
                        "rss": {
                            "bytes": 0
                        },
                        "rss_huge": {
                            "bytes": 0
                        },
                        "swap": {
                            "bytes": 0
                        },
                        "unevictable": {
                            "bytes": 0
                        }
                    }
                },
                "path": "/docker/d88e67bb6961a5bb70c1c1c48094c6030e43768eed91e827f437111888f9967e"
            },
            "cmdline": "go test -tags=integration github.com/elastic/beats/metricbeat/module/... -data",
            "cpu": {
                "start_time": "2017-12-07T07:20:59.000Z",
                "total": {
                    "norm": {
                        "pct": 0.0099
                    },
                    "pct": 0.0397
                }
            },
            "cwd": "/go/src/github.com/elastic/beats/metricbeat",
            "fd": {
                "limit": {
                    "hard": 1048576,
                    "soft": 1048576
                },
                "open": 8
            },
            "memory": {
                "rss": {
                    "bytes": 14540800,
                    "pct": 0.0035
                },
                "share": 0,
                "size": 402231296
            },
            "name": "go",
            "pgid": 1,
            "pid": 1,
            "ppid": 0,
            "state": "sleeping",
            "username": "root"
        }
    }
}
« System network metricset System process_summary metricset »

On this page

Was this helpful?
Feedback