Brewing in Beats: Introduce processors
Welcome to Brewing in Beats! With this series, we're keeping you up to date with all that's new in Beats, from the details of work in progress pull requests to releases and learning resources.
Metricbeat: Use half floats
Elasticsearch added support for half floats in the 5.0.0-alpha4 release. The Beats make use of the half floats for the percentage values (a float value between 0 and 1) and for the other float values that are expected to be small.
Filebeat: Add more configuration options to help with files management
There are couple of configuration options added in Filebeat to deal with corner cases:
- Closes the file handler as soon as harvester reaches the end of the file
- Introduce ttl and timestamp in harvester
- Introduce close_removed and close_renamed instead of force_close_files and deprecate force_close_files
Topbeat 1.x: Fix high values of CPU usage
There is a bug in the Topbeat 1.2.x series that reports high values of the CPU usage on Windows. The bug fix will be available in the next release of Topbeat 1.x and is already fixed in the 5.0 alphas.
libbeat: Rename filters with processors
The filters
configuration option helps you reduce the fields from the exported event. To align with the naming in the Ingest Node and Logstash, we are renaming the configuration option to processors
. In addition, we are planning to extend its functionality and use it to enhance the event with additional fields. This change breaks the compatibility with the previous version of the Beats.
All Beats: Update the definition of the condition in processor
While renaming filters
with processors
and extending its functionality, we decided to use the when keyword to introduce the condition associated to the processor in order to differentiate its borders from the action associated with the processor.
Before
processors: - include_fields: equals: proc.pid: 3455 fields: ["proc.cpu", "proc.mem"]
After
processors: - include_fields: when: equals: proc.pid: 3455 fields: ["proc.cpu", "proc.mem"]
Metricbeat: the system module now compiles on FreeBSD
The system module of Metricbeat is using the elastic/gosigar library to gather system statistics like the CPU and memory usage, disk usage, file system usage. Thanks to @knz, the gosigar library has now support for FreeBSD.