Beats: Metricbeat docker network module interface data duplicated

[vshypyguzov]

We are running metricbeat 7.4.1 with the following config:

metricbeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: false

metricbeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true

metricbeat.modules:
- module: docker
  metricsets:
    - container
    - cpu
    - diskio
    - healthcheck
    - info
    - memory
    - network
  hosts: 
  - unix:///var/run/docker.sock
  period: 10s
  enabled: true

We use it to monitor containers that have two network interfaces: eth0 and eth1
Network stats are always duplicated, sometimes it is data for one interface and sometimes for another. But never for both. Please see screenshot attached

Raw data looks like this:

{
 "eth0": {
    "rx_bytes": 370994027,
    "rx_packets": 1128448,
    "rx_errors": 0,
    "rx_dropped": 0,
    "tx_bytes": 166864781,
    "tx_packets": 1151859,
    "tx_errors": 0,
    "tx_dropped": 0
  },
  "eth1": {
    "rx_bytes": 245669534,
    "rx_packets": 186830,
    "rx_errors": 0,
    "rx_dropped": 0,
    "tx_bytes": 9035196,
    "tx_packets": 82444,
    "tx_errors": 0,
    "tx_dropped": 0
  }
}

[exekias]

Hi @vshypyguzov,

In order to check if something is wrong with the data you could manually query docker for this same info. Take the container ID of one of the running containers and run:

curl --unix-socket /var/run/docker.sock http://localhost/containers/<YOUR_CONTAINER_ID>/stats\?stream\=false 

Could you share the result of running that + the event from Metricbeat for this container?

[vshypyguzov]

Hi @exekias
Raw data that was mentioned before is exactly what your are asking for

[exekias]

Thanks, I missed that :innocent:. This looks like a bug, it would be awesome to have a way to reproduce it. I wonder how are you configuring the container? I guess it belongs to several networks, anything special apart from that?

[vshypyguzov]

@exekias Not sure if it counts, but we use Traefik to route traffic through our containers, so most of them indeed have two networks attached: traefik-net and default one.
Other then that nothing special about them

[odacremolbap]

I think there is a culprit at code.
Let try to reproduce to confirm.

[exekias]

@odacremolbap I think we can close this one already?

[odacremolbap]

yes, closing

[loekvangool]

@odacremolbap can we confirm which release(s) this will be in?

[andresrc]

Hi @loekvangool, this should be in 7.5.2 and 7.6.0

Thanks!