topbeat - exclude filesystems

[RuBiCK]

It would be great if topbeat could do something like exclude_filesystems with regex, like filebeat does with exclude_files

It will be useful for filesystems like "tmpfs", "proc", "sys", "dev", etc...

I have about seven in memory filesystems per server like mentioned above, for about 200 servers sending this data each minute, that is a lot of useless information that I would like to filter and do not send to ES

[monicasarbu]

The issue duplicates #914.

[monicasarbu]

There are two options here: one would be to add a configuration option in topbeat as you suggested (exclude_filesystems) and the other would be to use generic filtering to drop the events that contain information about the undesired filesystems.

[monicasarbu]

Closing the issue as it duplicates #914.

[RuBiCK]

Thanks for the information @monicasarbu,

I have read #914 and #451 and It's difficult find documentation about how use it. It says:

define a generic filtering that is implemented in libbeat and used by all the Beats, instead of having a specific filtering implementation for each Beat.

But inside topbeat.yml there is libbeat config section but it only has: output, shipper and logging sections. Where should I put the filter conditions? as top level section?

[monicasarbu]

Actually none of the options that I presented is not yet implemented. Sorry for the confusion. We are working at the moment on the generic filtering feature and it will be available in one of the next major releases.