Skip to content

Clarify the type of container disk and network metrics #2259

@ChrsMark

Description

@ChrsMark

From https://www.elastic.co/guide/en/ecs/current/ecs-container.html the container.disk.*bytes and container.network.*.bytes are mentioned to be of type gauge.

However by looking into the code of docker Metricbeat module it seems that those should be defined as counters instead:

From https://github.com/elastic/beats/blob/89bcc33a9a90cbacceaa61fceec0e8d23073574c/metricbeat/module/docker/diskio/data.go#L61 we see that stats.servicedBytes.reads is used to get the value. This seems to be a counter.
This value is also reflected into diskio.read.bytes field which mentions that it is the total number (https://github.com/elastic/beats/blob/2c47ac8d7e3af05dc84c19ae5ff81aeaf3cca875/metricbeat/module/docker/diskio/_meta/fields.yml#L20) of bytes for the life of the container.

Same happens with the network related fields.

I performed some tests to check that these fields are only getting increased:
container

If those findings are valid we need to:

  1. Tune ECS accordingly to not mistakenly mention that those fields are gauges.
  2. Revisit the containerd implementation and verify that we emit counter values there as well: https://github.com/elastic/beats/blob/89bcc33a9a90cbacceaa61fceec0e8d23073574c/x-pack/metricbeat/module/containerd/blkio/blkio.go#L45

cc: @kaiyan-sheng @MichaelKatsoulis @mlunadia

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions