System users metricsetedit

This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.

The system/users metricset reports logged in users and associated sessions via dbus and logind, which is a systemd component. By default, the metricset will look in /var/run/dbus/ for a system socket, although a new path can be selected with DBUS_SYSTEM_BUS_ADDRESS.

This metricset is available on:

  • Linux


There are no configuration options for this metricset.


For a description of each field in the metricset, see the exported fields section.

Here is an example document generated by this metricset:

    "@timestamp": "2017-10-12T08:05:34.853Z",
    "event": {
        "dataset": "system.users",
        "duration": 115000,
        "module": "system"
    "metricset": {
        "name": "users",
        "period": 10000
    "process": {
        "pid": 10786
    "service": {
        "type": "system"
    "source": {
        "ip": ""
    "system": {
        "users": {
            "id": 6,
            "leader": 10786,
            "path": "/org/freedesktop/login1/session/_36",
            "remote": true,
            "remote_host": "",
            "scope": "session-6.scope",
            "seat": "",
            "service": "sshd",
            "state": "active",
            "type": "tty"
    "user": {
        "id": "1000",
        "name": "alexk"