# Procstat plugin can not match correct process

**URL:** <https://community.influxdata.com/t/procstat-plugin-can-not-match-correct-process/57341>\
**Category:** Telegraf\
**Tags:** plugin\
**Created:** [May 30, 2025, 3:11pm UTC](https://community.influxdata.com/t/procstat-plugin-can-not-match-correct-process/57341 "2025-05-30T15:11:16Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tu-114-s-undercarria](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/tu-114-s-undercarria/32/19936_2.png) [@Tu-114-s-undercarria](https://community.influxdata.com/u/Tu-114-s-undercarria)\
**Post date:** [May 30, 2025, 3:11pm UTC](https://community.influxdata.com/t/procstat-plugin-can-not-match-correct-process/57341/1 "2025-05-30T15:11:16Z")

</div>

I’m attempting to use Telegraf’s procstat plugin to monitor the status of the filebeat process on a server and write this data into InfluxDB.  
First, I created a demo to confirm that my procstat plugin works correctly. My configuration file is as follows:

```auto
[global_tags]
  ip_address = "xxxxxx"
[agent]
    interval = "5s"
    round_interval = true
    metric_batch_size = 1000
    metric_buffer_limit = 10000
    collection_jitter = "0s"
    flush_interval = "10s"
    flush_jitter = "0s"
    precision = "0s"
    hostname= ""
    omit_hostname = false
[[outputs.influxdb_v2]]
    urls = ["http://xxxxxx:8086"]
    token = "xxxxxx"
    organization = "xxxxxx"
    bucket = "telegraf"
[[inputs.procstat]]
    pattern = "filebeat"
    metric_version = 2

```

After starting Telegraf, I could successfully see the collected information in InfluxDB. Due to the possibility of multiple filebeat processes (with binaries located in different directories) running on the server, I wanted to specify the absolute path to the filebeat binary. Therefore, I modified my Telegraf configuration file as follows:

```auto
[global_tags]
  ip_address = "xxxxxx"
... ...
[[inputs.procstat]]
    exe = "/usr/share/filebeat/bin/filebeat"
    metric_version = 2

```

Also not working for below configuration:

```auto
[global_tags]
  ip_address = "xxxxxx"
... ...
[[inputs.procstat]]
    cmdline = "/usr/share/filebeat/bin/filebeat.*"
    metric_version = 2

```

After restarting the Telegraf service, I found that it could no longer collect process information.  
Regarding the monitored process itself, the following command line output is provided for reference:

```bash
# ps -aux | grep filebeat | grep -v grep
root 979 0.0 0.0 3196572 22652 ? Ssl 2024 206:10 /usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat
# pgrep -l filebeat
979 filebeat
# cat /proc/979/cmdline 
/usr/share/filebeat/bin/filebeat-c/etc/filebeat/filebeat.yml-path.home/usr/share/filebeat-path.config/etc/filebeat-path.data/var/lib/filebeat-path.logs/var/log/filebeat

```

---

<div class="post-metadata">

**Author:** ![skartikey](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/skartikey/32/19710_2.png) [@skartikey](https://community.influxdata.com/u/skartikey)\
**Post date:** [May 30, 2025, 4:57pm UTC](https://community.influxdata.com/t/procstat-plugin-can-not-match-correct-process/57341/2 "2025-05-30T16:57:23Z")

</div>

@Tu-114-s-undercarria Welcome to the InfluxData community!

From your output:

- **Executable path** : `/usr/share/filebeat/bin/filebeat`
- **Process ID** : 979
- **Full command line** : Contains multiple arguments with paths

## Recommended Solutions

### Option 1: Use PID (for testing)

```toml
[[inputs.procstat]]
    pid = 979
    metric_version = 2

```

### Option 2: Use exe with exact path (should work)

```toml
[[inputs.procstat]]
    exe = "/usr/share/filebeat/bin/filebeat"
    metric_version = 2

```

### Option 3: Use pattern (most reliable)

```toml
[[inputs.procstat]]
    pattern = "filebeat"
    exe = "/usr/share/filebeat/bin/filebeat"
    metric_version = 2

```

### Option 4: Use cmdline without regex

```toml
[[inputs.procstat]]
    cmdline = "/usr/share/filebeat/bin/filebeat"
    metric_version = 2

```

## Debugging Steps

1. **Test Telegraf configuration** :

2. **Check Telegraf permissions** :

3. **Verify process is still running** :

4. **Check Telegraf logs** :

## Most Likely Issue

The `exe = "/usr/share/filebeat/bin/filebeat"` configuration should work. If it’s not working, check:

1. **Telegraf service permissions** - ensure the telegraf user has permission to read process information
2. **SELinux/AppArmor restrictions** if enabled
3. **Telegraf service timing** - ensure filebeat starts before telegraf

Try the pattern + exe combination first, as it’s the most reliable approach for your use case.