- Heartbeat Reference: other versions:
- Heartbeat overview
- Quick start: installation and configuration
- Set up and run
- Configure
- Monitors
- Task scheduler
- General settings
- Project paths
- Output
- Kerberos
- SSL
- Index lifecycle management (ILM)
- Elasticsearch index template
- Processors
- Define processors
- add_cloud_metadata
- add_cloudfoundry_metadata
- add_docker_metadata
- add_fields
- add_host_metadata
- add_id
- add_kubernetes_metadata
- add_labels
- add_locale
- add_network_direction
- add_nomad_metadata
- add_observer_metadata
- add_process_metadata
- add_tags
- append
- community_id
- convert
- copy_fields
- decode_base64_field
- decode_duration
- decode_json_fields
- decode_xml
- decode_xml_wineventlog
- decompress_gzip_field
- detect_mime_type
- dissect
- dns
- drop_event
- drop_fields
- extract_array
- fingerprint
- include_fields
- move_fields
- rate_limit
- registered_domain
- rename
- replace
- script
- syslog
- translate_ldap_attribute
- translate_sid
- truncate_fields
- urldecode
- Autodiscover
- Internal queue
- Logging
- HTTP endpoint
- Regular expression support
- Instrumentation
- Feature flags
- heartbeat.reference.yml
- How to guides
- Exported fields
- Beat fields
- Synthetics browser metrics fields
- Cloud provider metadata fields
- Common heartbeat monitor fields
- Docker fields
- ECS fields
- Host fields
- HTTP monitor fields
- ICMP fields
- Jolokia Discovery autodiscover provider fields
- Kubernetes fields
- Process fields
- Host lookup fields
- APM Service fields
- SOCKS5 proxy fields
- Monitor state fields
- Monitor summary fields
- Synthetics types fields
- TCP layer fields
- TLS encryption layer fields
- Monitor
- Secure
- Troubleshoot
- Get help
- Debug
- Understand logged metrics
- Common problems
- Heartbeat uses too much bandwidth
- Error loading config file
- Found unexpected or unknown characters
- Logstash connection doesn’t work
- Publishing to Logstash fails with "connection reset by peer" message
- @metadata is missing in Logstash
- Not sure whether to use Logstash or Beats
- SSL client fails to connect to Logstash
- Monitoring UI shows fewer Beats than expected
- High RSS memory usage due to MADV settings
- Contribute to Beats
Understand metrics in Heartbeat logs
editUnderstand metrics in Heartbeat logs
editEvery 30 seconds (by default), Heartbeat collects a snapshot of metrics about itself. From this snapshot, Heartbeat computes a delta snapshot; this delta snapshot contains any metrics that have changed since the last snapshot. Note that the values of the metrics are the values when the snapshot is taken, NOT the difference in values from the last snapshot.
If this delta snapshot contains any metrics (indicating at least one metric that has changed since the last snapshot), this delta snapshot is serialized as JSON and emitted in Heartbeat’s logs at the INFO
log level. Most snapshot fields report the change in the metric since the last snapshot, however some fields are gauges, which always report the current value. Here is an example of such a log entry:
{"log.level":"info","@timestamp":"2023-07-14T12:50:36.811Z","log.logger":"monitoring","log.origin":{"file.name":"log/log.go","file.line":187},"message":"Non-zero metrics in the last 30s","service.name":"filebeat","monitoring":{"metrics":{"beat":{"cgroup":{"memory":{"mem":{"usage":{"bytes":0}}}},"cpu":{"system":{"ticks":692690,"time":{"ms":60}},"total":{"ticks":3167250,"time":{"ms":150},"value":3167250},"user":{"ticks":2474560,"time":{"ms":90}}},"handles":{"limit":{"hard":1048576,"soft":1048576},"open":32},"info":{"ephemeral_id":"2bab8688-34c0-4522-80af-db86948d547d","uptime":{"ms":617670096},"version":"8.6.2"},"memstats":{"gc_next":57189272,"memory_alloc":43589824,"memory_total":275281335792,"rss":183574528},"runtime":{"goroutines":212}},"filebeat":{"events":{"active":5,"added":52,"done":49},"harvester":{"open_files":6,"running":6,"started":1}},"libbeat":{"config":{"module":{"running":15}},"output":{"events":{"acked":48,"active":0,"batches":6,"total":48},"read":{"bytes":210},"write":{"bytes":26923}},"pipeline":{"clients":15,"events":{"active":5,"filtered":1,"published":51,"total":52},"queue":{"max_events":3500,"filled":{"events":5,"bytes":6425,"pct":0.0014},"added":{"events":52,"bytes":65702},"consumed":{"events":52,"bytes":65702},"removed":{"events":48,"bytes":59277},"acked":48}}},"registrar":{"states":{"current":14,"update":49},"writes":{"success":6,"total":6}},"system":{"load":{"1":0.91,"15":0.37,"5":0.4,"norm":{"1":0.1138,"15":0.0463,"5":0.05}}}},"ecs.version":"1.6.0"}}
Details
editFocussing on the .monitoring.metrics
field, and formatting the JSON, it’s value is:
{ "beat": { "cgroup": { "memory": { "mem": { "usage": { "bytes": 0 } } } }, "cpu": { "system": { "ticks": 692690, "time": { "ms": 60 } }, "total": { "ticks": 3167250, "time": { "ms": 150 }, "value": 3167250 }, "user": { "ticks": 2474560, "time": { "ms": 90 } } }, "handles": { "limit": { "hard": 1048576, "soft": 1048576 }, "open": 32 }, "info": { "ephemeral_id": "2bab8688-34c0-4522-80af-db86948d547d", "uptime": { "ms": 617670096 }, "version": "8.6.2" }, "memstats": { "gc_next": 57189272, "memory_alloc": 43589824, "memory_total": 275281335792, "rss": 183574528 }, "runtime": { "goroutines": 212 } }, "filebeat": { "events": { "active": 5, "added": 52, "done": 49 }, "harvester": { "open_files": 6, "running": 6, "started": 1 } }, "libbeat": { "config": { "module": { "running": 15 } }, "output": { "events": { "acked": 48, "active": 0, "batches": 6, "total": 48 }, "read": { "bytes": 210 }, "write": { "bytes": 26923 } }, "pipeline": { "clients": 15, "events": { "active": 5, "filtered": 1, "published": 51, "total": 52 }, "queue": { "max_events": 3500, "filled": { "events": 5, "bytes": 6425, "pct": 0.0014 }, "added": { "events": 52, "bytes": 65702 }, "consumed": { "events": 52, "bytes": 65702 }, "removed": { "events": 48, "bytes": 59277 }, "acked": 48 } } }, "registrar": { "states": { "current": 14, "update": 49 }, "writes": { "success": 6, "total": 6 } }, "system": { "load": { "1": 0.91, "15": 0.37, "5": 0.4, "norm": { "1": 0.1138, "15": 0.0463, "5": 0.05 } } } }
The following tables explain the meaning of the most important fields under .monitoring.metrics
and also provide hints that might be helpful in troubleshooting Heartbeat issues.
Field path (relative to .monitoring.metrics ) |
Type | Meaning | Troubleshooting hints |
---|---|---|---|
|
Object |
Information that is common to all Beats, e.g. version, goroutines, file handles, CPU, memory |
|
|
Object |
Information about the publisher pipeline and output, also common to all Beats |
Field path (relative to .monitoring.metrics.beat ) |
Type | Meaning | Troubleshooting hints |
---|---|---|---|
|
Integer |
Number of goroutines running |
If this number grows over time, it indicates a goroutine leak |
Field path (relative to .monitoring.metrics.libbeat ) |
Type | Meaning | Troubleshooting hints |
---|---|---|---|
|
Integer |
Number of events currently in the libbeat publisher pipeline. |
If this number grows over time, it may indicate that Heartbeat is producing events faster than the output can consume them. Consider increasing the number of output workers (if this setting is supported by the output; Elasticsearch and Logstash outputs support this setting). The pipeline includes events currently being processed as well as events in the queue. So this metric can sometimes end up slightly higher than the queue size. If this metric reaches the maximum queue size ( |
|
Integer |
Number of events currently being processed by the output. |
If this number grows over time, it may indicate that the output destination (e.g. Logstash pipeline or Elasticsearch cluster) is not able to accept events at the same or faster rate than what Heartbeat is sending to it. |
|
Integer |
Number of events acknowledged by the output destination. |
Generally, we want this number to be the same as |
|
Integer |
Number of events that Heartbeat tried to send to the output destination, but the destination failed to receive them. |
Generally, we want this field to be absent or its value to be zero. When the value is greater than zero, it’s useful to check Heartbeat’s logs right before this log entry’s |
|
Integer |
Number of events that Heartbeat gave up sending to the output destination because of a permanent (non-retryable) error. |
|
Integer |
Number of events that Heartbeat successfully sent to a configured dead letter index after they failed to ingest in the primary index. |
|
Object |
Field path (relative to .monitoring.metrics.libbeat.pipeline ) |
Type | Meaning | Troubleshooting hints |
---|---|---|---|
|
Integer (gauge) |
The queue’s maximum event count if it has one, otherwise zero. |
|
Integer (gauge) |
The queue’s maximum byte count if it has one, otherwise zero. |
|
Integer (gauge) |
Number of events currently stored by the queue. |
|
Integer (gauge) |
|
Number of bytes currently stored by the queue. |
|
Float (gauge) |
|
How full the queue is relative to its maximum size, as a fraction from 0 to 1. |
Low throughput while |
|
Integer |
Number of events added to the queue by input workers. |
|
Integer |
|
Number of bytes added to the queue by input workers. |
|
Integer |
|
Number of events sent to output workers. |
|
Integer |
|
Number of bytes sent to output workers. |
|
Integer |
|
Number of events removed from the queue after being processed by output workers. |
|
Integer |
When using the memory queue, byte metrics are only set if the output supports them. Currently only the Elasticsearch output supports byte metrics.
Useful commands
editParse monitoring metrics from unstructured Heartbeat logs
editFor Heartbeat versions that emit unstructured logs, the following script can be used to parse monitoring metrics from such logs: https://github.com/elastic/beats/blob/main/script/metrics_from_log_file.sh.