elastic / elastic/beats

[metricbeat] system/filesystem: prefer hostfs-prefixed mount points when deduplicating devices

Open
#49,419 6 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Team:Elastic-Agent-Data-Plane
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 1h
Merged PRs (30d)
370

Description

When a block device is mounted multiple times (e.g. bind mounts), the `system/filesystem` metricset deduplicates entries keeping only one mount point per device. The current logic always picks the **shortest** path. This is incorrect when `hostfs` is configured (the standard container-based monitoring setup), because container-local paths like `/` are shorter than the host paths like `/hostfs`, so the host mount points — the ones the user actually wants — get discarded.

The deduplication should use the following precedence for choosing which mount point to keep for a given device:
1. Prefer paths under the `hostfs` prefix when `hostfs` is configured.
2. Among paths with equal prefix status, prefer the shorter path (current behavior, as tiebreaker).

When `hostfs` is not configured, behavior stays the same.

The fix spans two repositories:
- **`elastic-agent-system-metrics`** — the [`filterDuplicates`](https://github.com/elastic/elastic-agent-system-metrics/blob/main/metric/system/filesystem/filesystem.go#L150-L174) function needs to accept the `resolve.Resolver` (or the hostfs prefix) and apply the new precedence logic.
- **`elastic/beats`** — the [`Fetch` method in `metricbeat/module/system/filesystem/filesystem.go`](https://github.com/elastic/beats/blob/main/metricbeat/module/system/filesystem/filesystem.go#L80-L107) calls `GetFilesystems`, which calls `filterDuplicates`. After the library is updated, bump the dependency and add a test in metricbeat that proves hostfs-prefixed paths are preferred.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with filterDuplicates in elastic-agent-system-metrics/metric/system/filesystem/filesystem.go and trace how Fetch in metricbeat/module/system/filesystem/filesystem.go reaches it through GetFilesystems. Check the existing filesystem tests, then verify that hostfs-prefixed paths win when configured, shorter paths remain the tiebreaker, and behavior is unchanged without hostfs.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
observability-sre
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.