elastic / elastic/beats

[Filebeat] udp input metrics - indicate when system_packet_drops is unavailable

Open
#41,130 2 comments 0 reactions 0 assignees View on GitHub
enhancement Filebeat Stalled Team:Security-Deployment and Devices
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 1h
Merged PRs (30d)
370

Description

**Describe the enhancement:**

For the [UDP input metrics](https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-input-udp.html#_metrics_15), make it clear when the data is invalid. The availability of these two metrics depends on the host:

- `system_packet_drops`
- `receive_queue_length`

My suggestion is to report the values as `-1` at initialization or after any error.

**Describe a specific use case for the enhancement or feature:**

A `system_packet_drops` value of `0` is a indicator of health, but if zero is being reported because of a collection failure (or because we are on Windows), then we have a false sense of the current state. When troubleshooting I need to know if the metric is valid.

References

- https://github.com/elastic/beats/blob/c70d2d8ce0c990de16528fcfae812a44a23ba435/filebeat/input/netmetrics/udp.go#L69C1-L70C67

Contributor guide

Open the contributing guide

Research direction

Start in filebeat/input/netmetrics/udp.go at the referenced lines and trace how system_packet_drops and receive_queue_length are initialized and updated. Confirm the existing UDP metrics behavior, then ensure unavailable or failed collection is distinguishable from a valid zero by reporting -1 as proposed.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
observability-sre
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
64/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.