Beats: System module - Strange behavior when disabled metricsets will still collect metrics

[narph]

Events from other metricsets coming in although they have been disabled.

• when I run the cpu metricset even though I disable process and network in the system.yml config file metricset they are still running.
  Example config:

- module: system
  period: 10s
  metricsets:
    - cpu
    #- load
    #- memory
    #- network
    #- process
    #- process_summary
    #- socket_summary
    #- entropy
    #- core
    #- diskio
    #- socket
    #- service
    #- users
  process.include_top_n:
    by_cpu: 5      # include top 5 processes by CPU
    by_memory: 5   # include top 5 processes by memory

- module: system
  period: 1m
  metricsets:
    #- filesystem
    #- fsstat
  processors:
  - drop_event.when.regexp:
      system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/)'

- module: system
  period: 15m
  metricsets:
    - uptime

#- module: system
#  period: 5m
#  metricsets:
#    - raid
#  raid.mount_point: '/'

• same I run the memory metricset then process_summary and socket_summary events are also coming in, this behavior happens with the others also.

Windows 10, 64 bit

[elasticmachine]

Pinging @elastic/integrations-platforms (Team:Platforms)

[elasticmachine]

Pinging @elastic/integrations-services (Team:Services)

[fearful-symmetry]

Honestly not sure what's going on here. I'm able to reproduce this on linux as well. Starting up with the exact config posted above, I see this:

2020-10-19T12:27:15.022-0700    DEBUG   [module]        module/wrapper.go:127   Starting Wrapper[name=system, len(metricSetWrappers)=1]
2020-10-19T12:27:15.023-0700    DEBUG   [module]        module/wrapper.go:189   Starting metricSetWrapper[module=system, name=cpu, host=]

Which looks correct, and then this shortly after:

2020-10-19T12:27:15.034-0700    DEBUG   [reload]        cfgfile/list.go:105     Starting runner: RunnerGroup{system [metricsets=1], system [metricsets=1], s
ystem [metricsets=1], system [metricsets=1], system [metricsets=1], system [metricsets=1], system [metricsets=1], system [metricsets=1]}
2020-10-19T12:27:15.034-0700    DEBUG   [module]        module/wrapper.go:127   Starting Wrapper[name=system, len(metricSetWrappers)=1]
2020-10-19T12:27:15.035-0700    DEBUG   [module]        module/wrapper.go:127   Starting Wrapper[name=system, len(metricSetWrappers)=1]
2020-10-19T12:27:15.035-0700    DEBUG   [module]        module/wrapper.go:127   Starting Wrapper[name=system, len(metricSetWrappers)=1]
2020-10-19T12:27:15.035-0700    DEBUG   [module]        module/wrapper.go:189   Starting metricSetWrapper[module=system, name=socket_summary, host=]
2020-10-19T12:27:15.035-0700    DEBUG   [module]        module/wrapper.go:127   Starting Wrapper[name=system, len(metricSetWrappers)=1]
2020-10-19T12:27:15.035-0700    DEBUG   [module]        module/wrapper.go:127   Starting Wrapper[name=system, len(metricSetWrappers)=1]
2020-10-19T12:27:15.035-0700    DEBUG   [module]        module/wrapper.go:127   Starting Wrapper[name=system, len(metricSetWrappers)=1]
2020-10-19T12:27:15.035-0700    DEBUG   [module]        module/wrapper.go:127   Starting Wrapper[name=system, len(metricSetWrappers)=1]
2020-10-19T12:27:15.035-0700    DEBUG   [module]        module/wrapper.go:189   Starting metricSetWrapper[module=system, name=network, host=]
2020-10-19T12:27:15.035-0700    DEBUG   [module]        module/wrapper.go:189   Starting metricSetWrapper[module=system, name=process_summary, host=]
2020-10-19T12:27:15.035-0700    DEBUG   [module]        module/wrapper.go:189   Starting metricSetWrapper[module=system, name=load, host=]

[fearful-symmetry]

@narph can you post the rest of the metricbeat.yml config?

[fearful-symmetry]

Looks like a few people have tested this on master, and it's fine. This is something on 7.10 BC2.

[fearful-symmetry]

This is some kind of formatting or logic issue that's not exclusive to 7.10. This config works just fine:

- module: system
  period: 10s
  metricsets:
    - cpu
    #- load
    #- memory
    #- network
    #- process
    #- process_summary
    #- socket_summary
    #- entropy
    #- core
    #- diskio
    #- socket
    #- service
    #- users
  process.include_top_n:
    by_cpu: 5      # include top 5 processes by CPU
    by_memory: 5   # include top 5 processes by memory

Was able to reproduce this on 7.9 as well.

[fearful-symmetry]

Okay, figured it out, it doesn't like this:

- module: system
  period: 1m
  metricsets:
    #- filesystem
    #- fsstat
  processors:
  - drop_event.when.regexp:
      system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/)'

It treats that as a config with no metricset, hence it reverts to defaults.

[kaiyan-sheng]

Yes, same on macbook. It's the metricsets part that's causing the issue:

metricsets:
    #- filesystem
    #- fsstat

I tried with commenting out the processors and that didn't help.

[narph]

I have used the default metricbeat.yml file and only enabled debug logging.

[narph]

@fearful-symmetry , it makes sense , I did not reproduce this on Linux because I have not disabled fsstat or filesystem. Will close the issue, seems like expected behavior.