[metricbeat] Add memory.stat data to the docker/memory metricset

[fearful-symmetry]

Original issue here: #12855. This is an enhancement request from cloud that I figured could be fairly low-hanging so I'd like to get it out of the way.

I wasn't entirely sure how to implement this, and I chatted with a few folks about it, but I figured the best way to do it was to just put in a PR and we can debate about it here.

So, the issue is that the docker API returns a map[string]uint64, and the data itself is just scraped from the cgroup memory.stat interface, which is just in the kernel. The interface doesn't seem to be particularly well-documented, and there's a handful of ifdef statements and programmatic logic determining what is printed. The way I did it now is the simplest, with a stat.* type in fields.yml, and just passing the map into the MapStr object.

A few other ideas:

• schema.Apply. This seems to be a bit of a heavy hammer, as we have a set uint64 type and don't need to do much processing to the data itself
• Form a MapStr ourselves with the Stat object, so we can change Key names and have a explicit fields in the mapping. We could do this if we wanted to change key names or manipulate the map in other ways. We could also just keep the current implementation, but abandon stat.* in favor of more explicit mapping.

[fearful-symmetry]

Bah, broken test. Working on it.

[fearful-symmetry]

One thing I noticed while fixing the tests is that I'm passing the object to "stats" as a map[string]uint64 as opposed to common.MapStr. I don't see why this would be a problem, but noting it anyway.

[exekias]

This is looking good, will need a changelog

[fearful-symmetry]

Was gonna leave off the changelog until we were otherwise ready to merge.

[sayden]

Maybe, according to the naming conventions, this field should be called rss.count https://www.elastic.co/guide/en/beats/devguide/current/event-conventions.html

[fearful-symmetry]

How much do we want to fiddle with the stuff being scraped from the kernel interface? The full list of total_* events is generated programmatically by the kernel.

[fearful-symmetry]

Like, this is what's happening in the kernel:

for (i = 0; i < ARRAY_SIZE(memcg1_events); i++)
		seq_printf(m, "total_%s %llu\n", memcg1_event_names[i],
			   (u64)memcg_events(memcg, i));

	for (i = 0; i < NR_LRU_LISTS; i++)
		seq_printf(m, "total_%s %llu\n", mem_cgroup_lru_names[i],
			   (u64)memcg_page_state(memcg, NR_LRU_BASE + i) *
			   PAGE_SIZE);

Seems like a potential lost cause to figure out what possible fields we would need to re-parse?

[exekias]

having that Docker doesn't document these fields and is just passing them in raw I think that we could fail if we try to convert them. Could you update data.json? we should see how this looks by default there.

[jsoriano]

Just another opinion. I think that for this case it'd be fine to copy the stats map, as they are values taken directly from the OS, and I don't think they are going to change a lot. Also they seem to follow a good enough format (lowercase, snake case...).

But it is true that we risk to have fields explosion or other problems if some fancy feature is merged into the kernel.

Some things that we could do to improve this:

• Apply an schema to these memory stats, so we control what variables we collect, and potentially we adapt them to some other schema as Mario proposed (although I am fine with keeping the naming given by docker/OS)
• Explicitly document the fields we know (even if we leave the wildcard to catch new fields)

And +1 to have a data.json to have a better view of how it looks. It could be also nice to try it on Windows, to see if it has its own set of variables.

[fearful-symmetry]

Apply an schema to these memory stats

I initially thought of that, but schema.Apply seemed a bit like overkill considering everything is already a uint64. Should we just not use the type conversion part of it?

Explicitly document the fields we know (even if we leave the wildcard to catch new fields)

How would that work? Is there some way to document this besides fields.yml ?

[exekias]

passing this in raw sounds reasonable enough, worst case scenario at some point we discover this generates too much data, which seems unlikely anyway.

Updating data.json will help to give a good example of what to expect there

[jsoriano]

Explicitly document the fields we know (even if we leave the wildcard to catch new fields)

How would that work? Is there some way to document this besides fields.yml ?

Yeah, I mean to add to fields.yml the fields we know, but as they look like quite low level metrics, I am ok too with documenting the docker.memory.stats group only.

[fearful-symmetry]

Yah, the fact that they're so low level but also consistently typed makes me not too worried about them. I don't think there's any downside to the wildcard yml entry from the perspective of mapping, is there?

[kaiyan-sheng]

For discussion only, I'm not a fan of stats being map[string]uint64{} but the rest are common.MapStr{}. I would keep them all common.MapStr{}.

[fearful-symmetry]

Copying what we talked about on slack--there doesn't seem to be a pretty way to convert the values of the map without iterating over everything, which doesn't seem worth it in this case? I'm not set on it, though.

[fearful-symmetry]

Alright, updated data.json

[exekias]

thank you! this looks good to me, aside from the changelog

[fearful-symmetry]

Alright @exekias Changelog added!