Procstat plugin can not match correct process

Telegraf
1

I’m attempting to use Telegraf’s procstat plugin to monitor the status of the filebeat process on a server and write this data into InfluxDB.
First, I created a demo to confirm that my procstat plugin works correctly. My configuration file is as follows:

[global_tags]
  ip_address = "xxxxxx"
[agent]
    interval = "5s"
    round_interval = true
    metric_batch_size = 1000
    metric_buffer_limit = 10000
    collection_jitter = "0s"
    flush_interval = "10s"
    flush_jitter = "0s"
    precision = "0s"
    hostname= ""
    omit_hostname = false
[[outputs.influxdb_v2]]
    urls = ["http://xxxxxx:8086"]
    token = "xxxxxx"
    organization = "xxxxxx"
    bucket = "telegraf"
[[inputs.procstat]]
    pattern = "filebeat"
    metric_version = 2

After starting Telegraf, I could successfully see the collected information in InfluxDB. Due to the possibility of multiple filebeat processes (with binaries located in different directories) running on the server, I wanted to specify the absolute path to the filebeat binary. Therefore, I modified my Telegraf configuration file as follows:

[global_tags]
  ip_address = "xxxxxx"
... ...
[[inputs.procstat]]
    exe = "/usr/share/filebeat/bin/filebeat"
    metric_version = 2

Also not working for below configuration:

[global_tags]
  ip_address = "xxxxxx"
... ...
[[inputs.procstat]]
    cmdline = "/usr/share/filebeat/bin/filebeat.*"
    metric_version = 2

After restarting the Telegraf service, I found that it could no longer collect process information.
Regarding the monitored process itself, the following command line output is provided for reference:

# ps -aux | grep filebeat | grep -v grep
root       979  0.0  0.0 3196572 22652 ?       Ssl   2024 206:10 /usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat
# pgrep -l filebeat
979 filebeat
# cat /proc/979/cmdline 
/usr/share/filebeat/bin/filebeat-c/etc/filebeat/filebeat.yml-path.home/usr/share/filebeat-path.config/etc/filebeat-path.data/var/lib/filebeat-path.logs/var/log/filebeat
2

@Tu-114-s-undercarria Welcome to the InfluxData community!

From your output:

  • Executable path: /usr/share/filebeat/bin/filebeat
  • Process ID: 979
  • Full command line: Contains multiple arguments with paths

Recommended Solutions

Option 1: Use PID (for testing)

[[inputs.procstat]]
    pid = 979
    metric_version = 2

Option 2: Use exe with exact path (should work)

[[inputs.procstat]]
    exe = "/usr/share/filebeat/bin/filebeat"
    metric_version = 2

Option 3: Use pattern (most reliable)

[[inputs.procstat]]
    pattern = "filebeat"
    exe = "/usr/share/filebeat/bin/filebeat"
    metric_version = 2

Option 4: Use cmdline without regex

[[inputs.procstat]]
    cmdline = "/usr/share/filebeat/bin/filebeat"
    metric_version = 2

Debugging Steps

  1. Test Telegraf configuration:

    telegraf --config your-config.conf --test --input-filter procstat

  2. Check Telegraf permissions:

    # Ensure telegraf user can read /proc/979/
sudo -u telegraf cat /proc/979/cmdline

  3. Verify process is still running:

    ps -p 979

  4. Check Telegraf logs:

    journalctl -u telegraf -f

Most Likely Issue

The exe = "/usr/share/filebeat/bin/filebeat" configuration should work. If it’s not working, check:

  1. Telegraf service permissions - ensure the telegraf user has permission to read process information
  2. SELinux/AppArmor restrictions if enabled
  3. Telegraf service timing - ensure filebeat starts before telegraf

Try the pattern + exe combination first, as it’s the most reliable approach for your use case.