elastic / elastic/beats

Metricbeat - Monitor Stopped Processes

Open
#11,404 16 comments 8 reactions 0 assignees View on GitHub
[zube]: Backlog enhancement Metricbeat module Team:Integrations
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 15m
Merged PRs (30d)
385

Description

**Describe the enhancement:**
Add the ability to report if a process is not running in addition to its current process state. Possibly add an additional flag so that in additional to returning running or sleeping it will also report "not running" or "stopped" if the process is not part of the process list.

**Describe a specific use case for the enhancement or feature:**
The ability to report if a process is not running regardless of why it stopped, when it stopped and if it never started. This can be used for alerting on processes that can't use heartbeat.

Example system.yml:

- module: system
period: 10s
metricsets:
- process
- report-not-running
processes: ['kibana']

In the above scenario metricbeat would check every 10s and report the process state if it is running or sleeping, but it would also report that the process is not running if Metricbeat cannot find it in the running process list.

Contributor guide

Open the contributing guide

Research direction

Start by reading the Metricbeat system module's process metricset and its configuration handling. Trace how configured processes are matched and how running or sleeping states are reported. Done means a configured process absent from the process list produces a distinct stopped or not-running state on each reporting interval, while existing states remain unchanged.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
observability
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.