-
Notifications
You must be signed in to change notification settings - Fork 441
Description
From https://www.elastic.co/guide/en/ecs/current/ecs-container.html the container.disk.*bytes
and container.network.*.bytes
are mentioned to be of type gauge
.
However by looking into the code of docker Metricbeat module it seems that those should be defined as counter
s instead:
From https://github.com/elastic/beats/blob/89bcc33a9a90cbacceaa61fceec0e8d23073574c/metricbeat/module/docker/diskio/data.go#L61 we see that stats.servicedBytes.reads
is used to get the value. This seems to be a counter.
This value is also reflected into diskio.read.bytes
field which mentions that it is the total number (https://github.com/elastic/beats/blob/2c47ac8d7e3af05dc84c19ae5ff81aeaf3cca875/metricbeat/module/docker/diskio/_meta/fields.yml#L20) of bytes for the life of the container.
Same happens with the network related fields.
I performed some tests to check that these fields are only getting increased:
If those findings are valid we need to:
- Tune ECS accordingly to not mistakenly mention that those fields are gauges.
- Revisit the
containerd
implementation and verify that we emit counter values there as well: https://github.com/elastic/beats/blob/89bcc33a9a90cbacceaa61fceec0e8d23073574c/x-pack/metricbeat/module/containerd/blkio/blkio.go#L45