Metricbeat is a lightweight tool for collecting and shipping metrics.
Metricbeat collects a large set of valuable system metrics, including:
On top of the system-level statistics, Metricbeat comes with modules that offer integrations to many well-known services like Docker, MongoDB, and MySQL. Check out the Modules page in the official Metricbeat documentation for more details on these integrations and how they work. You might also read their Getting Started Guide.
To download Metricbeat, visit the Metricbeat OSS downloads page.
You can find installation documentation for Metricbeat on the Installation page of the official Metricbeat website.
This documentation is written for versions 6.x of Metricbeat. Either make sure to install from the 6.x branch (https://www.elastic.co/guide/en/beats/metricbeat/6.8/metricbeat-installation.html) or make sure to read https://www.elastic.co/guide/en/beats/libbeat/7.6/breaking-changes-7.0.html to know what fields are available in the 7.x metrics.
Because Humio supports parts of the ElasticSearch insertion API, you can send data from Metricbeat to Humio by configuring Metricbeat to use the built-in ElasticSearch output.
You can find configuration documentation for Metricbeat at the Metricbeat configuration page.
The following example shows a simple Metricbeat configuration collecting host metrics and sending them to Humio:
metricbeat.modules: - module: system enabled: true period: 10s metricsets: - cpu - load - filesystem - fsstat - memory - network - socket # linux only output.elasticsearch: hosts: ["$YOUR_HUMIO_URL/api/v1/ingest/elastic-bulk"] username: my-organization password: $INGEST_TOKEN
$YOUR_HUMIO_URL variable is the base URL of your Humio server, either (
$INGEST_TOKEN is the ingest token for your repository, (i.e., a string such as
Metricbeat uses 9200 as the default port, if no port is specified. So if Humio is listening on the default ports 80 or 443, these ports should be explicitly put in the
The Metricbeat configuration file is located at
/etc/metricbeat/metricbeat.yml on Linux.
Run Metricbeat as a service on Linux with the following commands
sudo systemctl enable metricbeat sudo systemctl restart metricbeat
You can add fields with static values using the
fields section. These fields will be added to each event.
Metricbeat automatically sends the host name of the system along with the data. Humio adds the host name in the
@host field to each event. It uses this field name to try not to collide with other fields in the event.
Once you have data from Metricbeat in Humio, you can run some interesting queries, such as
#type=beat | timechart(series=@host, function=max(system.load.1, as=load))
#type=beat | timechart(series=@host, function=max(system.memory.actual.used.bytes))
#type=beat @host=host1 system.filesystem.mount_point="/" | timechart(function=min(system.filesystem.free, as=free)) | eval(free=free/(1024*1024*1024))
#type=beat @host=host1 | system.diskio.read.bytes=* | timechart( series=system.diskio.name, function=counterAsRate(system.diskio.read.bytes), span=1m )
#type=beat @host=host1 system.network.name=eth0 | timechart(function=count(system.network.out.bytes), span=1m)
#type=beat | system.process.name=* | groupBy(system.process.name, function=avg(system.process.cpu.total.pct, as=cpu)) | sort(cpu, limit=10)